diff options
| author | Trond Myklebust <trond.myklebust@primarydata.com> | 2016-09-20 20:33:42 +0200 |
|---|---|---|
| committer | Anna Schumaker <Anna.Schumaker@Netapp.com> | 2016-09-22 23:12:31 +0200 |
| commit | ace0e14f4fe5f5944d27d8bd4d3492ad0d2b09e2 (patch) | |
| tree | 092e8ffd8c0350a79d40be6b6318d20c8b61b87c | |
| parent | NFS: nfs_prime_dcache must validate the filename (diff) | |
| download | linux-ace0e14f4fe5f5944d27d8bd4d3492ad0d2b09e2.tar.xz linux-ace0e14f4fe5f5944d27d8bd4d3492ad0d2b09e2.zip | |
SUNRPC: Fix corruption of xdr->nwords in xdr_copy_to_scratch
When we copy the first part of the data, we need to ensure that value
of xdr->nwords is updated as well. Do so by calling __xdr_inline_decode()
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
| -rw-r--r-- | net/sunrpc/xdr.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c index c4f3cc0c0775..b8444860edf5 100644 --- a/net/sunrpc/xdr.c +++ b/net/sunrpc/xdr.c @@ -859,12 +859,15 @@ EXPORT_SYMBOL_GPL(xdr_set_scratch_buffer); static __be32 *xdr_copy_to_scratch(struct xdr_stream *xdr, size_t nbytes) { __be32 *p; - void *cpdest = xdr->scratch.iov_base; + char *cpdest = xdr->scratch.iov_base; size_t cplen = (char *)xdr->end - (char *)xdr->p; if (nbytes > xdr->scratch.iov_len) return NULL; - memcpy(cpdest, xdr->p, cplen); + p = __xdr_inline_decode(xdr, cplen); + if (p == NULL) + return NULL; + memcpy(cpdest, p, cplen); cpdest += cplen; nbytes -= cplen; if (!xdr_set_next_buffer(xdr)) |