diff options
| author | Bryan Schumaker <bjschuma@netapp.com> | 2012-12-08 01:17:29 +0400 |
|---|---|---|
| committer | J. Bruce Fields <bfields@redhat.com> | 2012-12-11 03:24:22 +0400 |
| commit | 18d9a2ca2ea1aa963a077fb49e7efcc3b0237a9b (patch) | |
| tree | 34fa5f3dc37c5e0ffde3ce73b816f8a0bf11ec38 | |
| parent | 0a5c33e23c4d781ecc815002c54f1f91012c703d (diff) | |
| download | linux-18d9a2ca2ea1aa963a077fb49e7efcc3b0237a9b.tar.xz | |
NFSD: Correct the size calculation in fault_inject_write
If len == 0 we end up with size = (0 - 1), which could cause bad things
to happen in copy_from_user().
Signed-off-by: Bryan Schumaker <bjschuma@netapp.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
| -rw-r--r-- | fs/nfsd/fault_inject.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/nfsd/fault_inject.c b/fs/nfsd/fault_inject.c index 7a7b079fbdb1..e761ee95617f 100644 --- a/fs/nfsd/fault_inject.c +++ b/fs/nfsd/fault_inject.c @@ -122,7 +122,7 @@ static ssize_t fault_inject_write(struct file *file, const char __user *buf, size_t len, loff_t *ppos) { char write_buf[INET6_ADDRSTRLEN]; - size_t size = min(sizeof(write_buf), len) - 1; + size_t size = min(sizeof(write_buf) - 1, len); struct net *net = current->nsproxy->net_ns; struct sockaddr_storage sa; u64 val; |