From patchwork Fri Dec 7 21:17:29 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bryan Schumaker X-Patchwork-Id: 1851801 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id C495EDF2EE for ; Fri, 7 Dec 2012 21:17:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1030864Ab2LGVRc (ORCPT ); Fri, 7 Dec 2012 16:17:32 -0500 Received: from mx2.netapp.com ([216.240.18.37]:32266 "EHLO mx2.netapp.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1030863Ab2LGVRc (ORCPT ); Fri, 7 Dec 2012 16:17:32 -0500 X-IronPort-AV: E=Sophos;i="4.84,240,1355126400"; d="scan'208";a="717060244" Received: from smtp1.corp.netapp.com ([10.57.156.124]) by mx2-out.netapp.com with ESMTP; 07 Dec 2012 13:17:32 -0800 Received: from davros.hq.netapp.com (davros.vpn.netapp.com [10.63.228.34]) by smtp1.corp.netapp.com (8.13.1/8.13.1/NTAP-1.6) with ESMTP id qB7LHT6b002883; Fri, 7 Dec 2012 13:17:31 -0800 (PST) From: bjschuma@netapp.com To: bfields@fieldses.org Cc: linux-nfs@vger.kernel.org Subject: [PATCH 2/2] NFSD: Correct the size calculation in fault_inject_write Date: Fri, 7 Dec 2012 16:17:29 -0500 Message-Id: <1354915049-6892-2-git-send-email-bjschuma@netapp.com> X-Mailer: git-send-email 1.8.0.1 In-Reply-To: <1354915049-6892-1-git-send-email-bjschuma@netapp.com> References: <1354915049-6892-1-git-send-email-bjschuma@netapp.com> Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: Bryan Schumaker If len == 0 we end up with size = (0 - 1), which could cause bad things to happen in copy_from_user(). Signed-off-by: Bryan Schumaker --- fs/nfsd/fault_inject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfsd/fault_inject.c b/fs/nfsd/fault_inject.c index 7a7b079..e761ee9 100644 --- a/fs/nfsd/fault_inject.c +++ b/fs/nfsd/fault_inject.c @@ -122,7 +122,7 @@ static ssize_t fault_inject_write(struct file *file, const char __user *buf, size_t len, loff_t *ppos) { char write_buf[INET6_ADDRSTRLEN]; - size_t size = min(sizeof(write_buf), len) - 1; + size_t size = min(sizeof(write_buf) - 1, len); struct net *net = current->nsproxy->net_ns; struct sockaddr_storage sa; u64 val;