diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2009-03-19 01:45:51 +0100 |
|---|---|---|
| committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2009-03-28 20:53:42 +0100 |
| commit | adbbe929569e6eec8ff9feca23f1f2b40b42853d (patch) | |
| tree | 2a22bb3d333f1471c1c6629e5947f56dd850611a /fs | |
| parent | SUNRPC: Clean up static inline functions in svc_xprt.h (diff) | |
| download | linux-adbbe929569e6eec8ff9feca23f1f2b40b42853d.tar.xz linux-adbbe929569e6eec8ff9feca23f1f2b40b42853d.zip | |
NFSD: If port value written to /proc/fs/nfsd/portlist is invalid, return EINVAL
Make sure port value read from user space by write_ports is valid before
passing it to svc_find_xprt(). If it wasn't, the writer would get ENOENT
instead of EINVAL.
Noticed-by: J. Bruce Fields <bfields@fieldses.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/nfsd/nfsctl.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 3d93b2064ce5..5a936c14f6ff 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -938,6 +938,8 @@ static ssize_t __write_ports(struct file *file, char *buf, size_t size) char transport[16]; int port; if (sscanf(buf, "%15s %4d", transport, &port) == 2) { + if (port < 1 || port > 65535) + return -EINVAL; err = nfsd_create_serv(); if (!err) { err = svc_create_xprt(nfsd_serv, @@ -960,7 +962,7 @@ static ssize_t __write_ports(struct file *file, char *buf, size_t size) char transport[16]; int port; if (sscanf(&buf[1], "%15s %4d", transport, &port) == 2) { - if (port == 0) + if (port < 1 || port > 65535) return -EINVAL; if (nfsd_serv) { xprt = svc_find_xprt(nfsd_serv, transport, |