Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6
* 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:
SUNRPC: Address buffer overrun in rpc_uaddr2sockaddr()
NFSv4: Fix a cache validation bug which causes getcwd() to return ENOENT
+9
-11
+1
-1
fs/nfs/nfs4proc.c
+1
-1
fs/nfs/nfs4proc.c
···
2767
2767
.pages = &page,
2768
2768
.pgbase = 0,
2769
2769
.count = count,
2770
-
.bitmask = NFS_SERVER(dentry->d_inode)->cache_consistency_bitmask,
2770
+
.bitmask = NFS_SERVER(dentry->d_inode)->attr_bitmask,
2771
2771
};
2772
2772
struct nfs4_readdir_res res;
2773
2773
struct rpc_message msg = {
+8
-10
net/sunrpc/addr.c
+8
-10
net/sunrpc/addr.c
···
306
306
* @sap: buffer into which to plant socket address
307
307
* @salen: size of buffer
308
308
*
309
+
* @uaddr does not have to be '\0'-terminated, but strict_strtoul() and
310
+
* rpc_pton() require proper string termination to be successful.
311
+
*
309
312
* Returns the size of the socket address if successful; otherwise
310
313
* zero is returned.
311
314
*/
312
315
size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
313
316
struct sockaddr *sap, const size_t salen)
314
317
{
315
-
char *c, buf[RPCBIND_MAXUADDRLEN];
318
+
char *c, buf[RPCBIND_MAXUADDRLEN + sizeof('\0')];
316
319
unsigned long portlo, porthi;
317
320
unsigned short port;
318
321
319
-
if (uaddr_len > sizeof(buf))
322
+
if (uaddr_len > RPCBIND_MAXUADDRLEN)
320
323
return 0;
321
324
322
325
memcpy(buf, uaddr, uaddr_len);
323
326
324
-
buf[uaddr_len] = '\n';
325
-
buf[uaddr_len + 1] = '\0';
326
-
327
+
buf[uaddr_len] = '\0';
327
328
c = strrchr(buf, '.');
328
329
if (unlikely(c == NULL))
329
330
return 0;
···
333
332
if (unlikely(portlo > 255))
334
333
return 0;
335
334
336
-
c[0] = '\n';
337
-
c[1] = '\0';
338
-
335
+
*c = '\0';
339
336
c = strrchr(buf, '.');
340
337
if (unlikely(c == NULL))
341
338
return 0;
···
344
345
345
346
port = (unsigned short)((porthi << 8) | portlo);
346
347
347
-
c[0] = '\0';
348
-
348
+
*c = '\0';
349
349
if (rpc_pton(buf, strlen(buf), sap, salen) == 0)
350
350
return 0;
351
351