Преглед на файлове

nfsd4: memory corruption in numeric_name_to_id()

"id" is type is a uid_t (32 bits) but on 64 bit systems strict_strtoul()
modifies 64 bits of data.  We should use kstrtouint() instead.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Dan Carpenter преди 13 години
родител
ревизия
3af706135b
променени са 1 файла, в които са добавени 1 реда и са изтрити 1 реда
  1. 1 1
      fs/nfsd/nfs4idmap.c

+ 1 - 1
fs/nfsd/nfs4idmap.c

@@ -581,7 +581,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel
 	/* Just to make sure it's null-terminated: */
 	memcpy(buf, name, namelen);
 	buf[namelen] = '\0';
-	ret = strict_strtoul(name, 10, (unsigned long *)id);
+	ret = kstrtouint(name, 10, id);
 	return ret == 0;
 }