diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-03-28 13:44:59 +0300 |
|---|---|---|
| committer | J. Bruce Fields <bfields@redhat.com> | 2012-03-28 10:10:23 -0400 |
| commit | 3af706135bcc06b1519ba50beaf1b47d32d0fc26 (patch) | |
| tree | 52ee3c46416e12fae8f9a1f6e7a6faa3cd3416ad /fs/nfsd | |
| parent | 92769108f5382a0bdb4c35eb80c183fb7797cfae (diff) | |
| download | op-kernel-dev-3af706135bcc06b1519ba50beaf1b47d32d0fc26.zip op-kernel-dev-3af706135bcc06b1519ba50beaf1b47d32d0fc26.tar.gz | |
nfsd4: memory corruption in numeric_name_to_id()
"id" is type is a uid_t (32 bits) but on 64 bit systems strict_strtoul()
modifies 64 bits of data. We should use kstrtouint() instead.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'fs/nfsd')
| -rw-r--r-- | fs/nfsd/nfs4idmap.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c index 69ca9c5..322d11c 100644 --- a/fs/nfsd/nfs4idmap.c +++ b/fs/nfsd/nfs4idmap.c @@ -581,7 +581,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel /* Just to make sure it's null-terminated: */ memcpy(buf, name, namelen); buf[namelen] = '\0'; - ret = strict_strtoul(name, 10, (unsigned long *)id); + ret = kstrtouint(name, 10, id); return ret == 0; } |
