• J. Bruce Fields's avatar
    nfsd: Fix handling of negative lengths in read_buf() · ca2a05aa
    J. Bruce Fields authored
    The length "nbytes" passed into read_buf should never be negative, but
    we check only for too-large values of "nbytes", not for too-small
    values.  Make nbytes unsigned, so it's clear that the former tests are
    sufficient.  (Despite this read_buf() currently correctly returns an xdr
    error in the case of a negative length, thanks to an unsigned
    comparison with size_of() and bounds-checking in kmalloc().  This seems
    very fragile, though.)
    Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
    ca2a05aa
nfs4xdr.c 68.3 KB