diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-01-18 12:56:02 +0300 |
|---|---|---|
| committer | Willy Tarreau <w@1wt.eu> | 2012-10-07 23:37:37 +0200 |
| commit | 0d1e8b8281ae7b43be54ec3409d299c99d7c975d (patch) | |
| tree | 0a401e92c210e81e77b082fc3f7861426c329188 /net | |
| parent | df2c68454e160d1635e1c1279036d573ce804d51 (diff) | |
nfsd: don't allow zero length strings in cache_parse()
commit 6d8d17499810479eabd10731179c04b2ca22152f upstream.
There is no point in passing a zero length string here and quite a
few of that cache_parse() implementations will Oops if count is
zero.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sunrpc/cache.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c index 25f7801e0ab..e3fea462e57 100644 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@ -719,6 +719,8 @@ static ssize_t cache_do_downcall(char *kaddr, const char __user *buf, { ssize_t ret; + if (count == 0) + return -EINVAL; if (copy_from_user(kaddr, buf, count)) return -EFAULT; kaddr[count] = '\0'; |