diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2008-01-26 06:02:29 +0100 |
|---|---|---|
| committer | David Teigland <teigland@redhat.com> | 2008-02-04 08:29:13 +0100 |
| commit | a9cc9159281d44754f621f75d4efad0076b29db4 (patch) | |
| tree | 8ee69182283251b06ed725dcd1fa0ed3c05423ec /fs/dlm/lock.c | |
| parent | dlm: make find_rsb() fail gracefully when namelen is too large (diff) | |
| download | linux-a9cc9159281d44754f621f75d4efad0076b29db4.tar.xz linux-a9cc9159281d44754f621f75d4efad0076b29db4.zip | |
dlm: fix overflows when copying from ->m_extra to lvb
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David Teigland <teigland@redhat.com>
Diffstat (limited to 'fs/dlm/lock.c')
| -rw-r--r-- | fs/dlm/lock.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c index 6d98cf9d043d..5b82187e0221 100644 --- a/fs/dlm/lock.c +++ b/fs/dlm/lock.c @@ -1226,6 +1226,8 @@ static void set_lvb_lock_pc(struct dlm_rsb *r, struct dlm_lkb *lkb, b = dlm_lvb_operations[lkb->lkb_grmode + 1][lkb->lkb_rqmode + 1]; if (b == 1) { int len = receive_extralen(ms); + if (len > DLM_RESNAME_MAXLEN) + len = DLM_RESNAME_MAXLEN; memcpy(lkb->lkb_lvbptr, ms->m_extra, len); lkb->lkb_lvbseq = ms->m_lvbseq; } @@ -2993,6 +2995,8 @@ static int receive_lvb(struct dlm_ls *ls, struct dlm_lkb *lkb, if (!lkb->lkb_lvbptr) return -ENOMEM; len = receive_extralen(ms); + if (len > DLM_RESNAME_MAXLEN) + len = DLM_RESNAME_MAXLEN; memcpy(lkb->lkb_lvbptr, ms->m_extra, len); } return 0; |