2 files changed, 12 insertions, 10 deletions

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 6851b003f2a4..8f029db5d271 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -617,15 +617,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 
         switch (create->cr_type) {
         case NF4LNK:
-                /* ugh! we have to null-terminate the linktext, or
-                 * vfs_symlink() will choke.  it is always safe to
-                 * null-terminate by brute force, since at worst we
-                 * will overwrite the first byte of the create namelen
-                 * in the XDR buffer, which has already been extracted
-                 * during XDR decode.
-                 */
-                create->cr_linkname[create->cr_linklen] = 0;
-
                 status = nfsd_symlink(rqstp, &cstate->current_fh,
                                       create->cr_name, create->cr_namelen,
                                       create->cr_linkname, create->cr_linklen,
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 83baf2bfe9e9..5b4fef55676a 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -600,7 +600,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create
                 READ_BUF(4);
                 create->cr_linklen = be32_to_cpup(p++);
                 READ_BUF(create->cr_linklen);
-                SAVEMEM(create->cr_linkname, create->cr_linklen);
+                /*
+                 * The VFS will want a null-terminated string, and
+                 * null-terminating in place isn't safe since this might
+                 * end on a page boundary:
+                 */
+                create->cr_linkname =
+                                kmalloc(create->cr_linklen + 1, GFP_KERNEL);
+                if (!create->cr_linkname)
+                        return nfserr_jukebox;
+                memcpy(create->cr_linkname, p, create->cr_linklen);
+                create->cr_linkname[create->cr_linklen] = '\0';
+                defer_free(argp, kfree, create->cr_linkname);
                 break;
         case NF4BLK:
         case NF4CHR: