2 files changed, 7 insertions, 6 deletions

diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index 49c7cd0502cc..779d2eb649c5 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -130,10 +130,11 @@ static int xdr_decode_fhstatus3(struct rpc_rqst *req, __be32 *p,
                                 struct mnt_fhstatus *res)
 {
         struct nfs_fh *fh = res->fh;
+        unsigned size;
 
         if ((res->status = ntohl(*p++)) == 0) {
-                int size = ntohl(*p++);
-                if (size <= NFS3_FHSIZE) {
+                size = ntohl(*p++);
+                if (size <= NFS3_FHSIZE && size != 0) {
                         fh->size = size;
                         memcpy(fh->data, p, size);
                 } else
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index dac663dc5611..614efeed5437 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1249,13 +1249,13 @@ static int nfs_validate_mount_data(void *options,
         case 5:
                 memset(data->context, 0, sizeof(data->context));
         case 6:
-                if (data->flags & NFS_MOUNT_VER3)
+                if (data->flags & NFS_MOUNT_VER3) {
+                        if (data->root.size > NFS3_FHSIZE || data->root.size == 0)
+                                goto out_invalid_fh;
                         mntfh->size = data->root.size;
-                else
+                } else
                         mntfh->size = NFS2_FHSIZE;
 
-                if (mntfh->size > sizeof(mntfh->data))
-                        goto out_invalid_fh;
 
                 memcpy(mntfh->data, data->root.data, mntfh->size);
                 if (mntfh->size < sizeof(mntfh->data))