diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2021-05-11 11:49:42 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-06-03 08:22:06 +0200 |
| commit | 9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040 (patch) | |
| tree | 6af037627323d1cde01d0901e6c890bfcd7e8576 /net/tipc/socket.c | |
| parent | 61a811e8f5229264b822361f8b23d7638fd8c914 (diff) | |
NFS: fix an incorrect limit in filelayout_decode_layout()
commit 769b01ea68b6c49dc3cde6adf7e53927dacbd3a8 upstream.
The "sizeof(struct nfs_fh)" is two bytes too large and could lead to
memory corruption. It should be NFS_MAXFHSIZE because that's the size
of the ->data[] buffer.
I reversed the size of the arguments to put the variable on the left.
Fixes: 16b374ca439f ("NFSv4.1: pnfs: filelayout: add driver's LAYOUTGET and GETDEVICEINFO infrastructure")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/tipc/socket.c')
0 files changed, 0 insertions, 0 deletions