diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-11-27 10:58:54 -0500 |
---|---|---|
committer | J. Bruce Fields <bfields@redhat.com> | 2014-12-01 14:45:28 -0500 |
commit | 818f2f57f20d0e9a9294180f304f34cd4e8f6066 (patch) | |
tree | ba82e5a7af67db82e583a8d36176c3f3e3e105ab /fs | |
parent | 067f96ef17455800bfbf87b743960e301e0b8e40 (diff) |
nfsd: minor off by one checks in __write_versions()
My static checker complains that if "len == remaining" then it means we
have truncated the last character off the version string.
The intent of the code is that we print as many versions as we can
without truncating a version. Then we put a newline at the end. If the
newline can't fit we return -EINVAL.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jeff Layton <jlayton@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'fs')
-rw-r--r-- | fs/nfsd/nfsctl.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index ca73ca79a0ee..0079b28270e9 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c | |||
@@ -606,7 +606,7 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size) | |||
606 | num); | 606 | num); |
607 | sep = " "; | 607 | sep = " "; |
608 | 608 | ||
609 | if (len > remaining) | 609 | if (len >= remaining) |
610 | break; | 610 | break; |
611 | remaining -= len; | 611 | remaining -= len; |
612 | buf += len; | 612 | buf += len; |
@@ -621,7 +621,7 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size) | |||
621 | '+' : '-', | 621 | '+' : '-', |
622 | minor); | 622 | minor); |
623 | 623 | ||
624 | if (len > remaining) | 624 | if (len >= remaining) |
625 | break; | 625 | break; |
626 | remaining -= len; | 626 | remaining -= len; |
627 | buf += len; | 627 | buf += len; |
@@ -629,7 +629,7 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size) | |||
629 | } | 629 | } |
630 | 630 | ||
631 | len = snprintf(buf, remaining, "\n"); | 631 | len = snprintf(buf, remaining, "\n"); |
632 | if (len > remaining) | 632 | if (len >= remaining) |
633 | return -EINVAL; | 633 | return -EINVAL; |
634 | return tlen + len; | 634 | return tlen + len; |
635 | } | 635 | } |