diff mbox

NFSD: pass null terminated buf to kstrtouint()

Message ID 1347204347-23706-1-git-send-email-malahal@us.ibm.com (mailing list archive)
State New, archived
Headers show

Commit Message

malahal naineni Sept. 9, 2012, 3:25 p.m. UTC
The 'buf' is prepared with null termination with intention of using it for
this purpose, but 'name' is passed instead!

Signed-off-by: Malahal Naineni <malahal@us.ibm.com>
---
 fs/nfsd/nfs4idmap.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

Comments

J. Bruce Fields Sept. 10, 2012, 9:46 p.m. UTC | #1
On Sun, Sep 09, 2012 at 10:25:47AM -0500, Malahal Naineni wrote:
> The 'buf' is prepared with null termination with intention of using it for
> this purpose, but 'name' is passed instead!

Thanks!--b.

> 
> Signed-off-by: Malahal Naineni <malahal@us.ibm.com>
> ---
>  fs/nfsd/nfs4idmap.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
> index fdc91a6..ccfe0d0 100644
> --- a/fs/nfsd/nfs4idmap.c
> +++ b/fs/nfsd/nfs4idmap.c
> @@ -598,7 +598,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel
>  	/* Just to make sure it's null-terminated: */
>  	memcpy(buf, name, namelen);
>  	buf[namelen] = '\0';
> -	ret = kstrtouint(name, 10, id);
> +	ret = kstrtouint(buf, 10, id);
>  	return ret == 0;
>  }
>  
> -- 
> 1.7.0.4
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
index fdc91a6..ccfe0d0 100644
--- a/fs/nfsd/nfs4idmap.c
+++ b/fs/nfsd/nfs4idmap.c
@@ -598,7 +598,7 @@  numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel
 	/* Just to make sure it's null-terminated: */
 	memcpy(buf, name, namelen);
 	buf[namelen] = '\0';
-	ret = kstrtouint(name, 10, id);
+	ret = kstrtouint(buf, 10, id);
 	return ret == 0;
 }