summaryrefslogtreecommitdiff
path: root/Documentation/DocBook
diff options
context:
space:
mode:
authorNeilBrown <neilb@suse.de>2012-09-17 10:46:34 +0400
committerTrond Myklebust <Trond.Myklebust@netapp.com>2012-09-25 18:38:54 +0400
commit62d98c935456ee121b03d6a68aa3091a04085b7e (patch)
tree09f58145bc10308f4672ee156a0ed23ea87c4f7b /Documentation/DocBook
parente8d920c58ddb45126e1b306854f6e34b88446baf (diff)
downloadlinux-62d98c935456ee121b03d6a68aa3091a04085b7e.tar.xz
NFS4: avoid underflow when converting error to pointer.
In nfs4_create_sec_client, 'flavor' can hold a negative error code (returned from nfs4_negotiate_security), even though it is an 'enum' and hence unsigned. The code is careful to cast it to an (int) before testing if it is negative, however it doesn't cast to an (int) before calling ERR_PTR. On a machine where "void*" is larger than "int", this results in the unsigned equivalent of -1 (e.g. 0xffffffff) being converted to a pointer. Subsequent code determines that this is not negative, and so dereferences it with predictable results. So: cast 'flavor' to a (signed) int before passing to ERR_PTR. cc: Benny Halevy <bhalevy@tonian.com> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'Documentation/DocBook')
0 files changed, 0 insertions, 0 deletions