There is a potential for integer overflows in svcxdr_dupstr() and svcxdr_tmpalloc() and XDR_QUADLEN(). I believe the fixing the overflow in XDR_QUADLEN() would fix the bug, but it's safer to be more thourough. Dan Carpenter (2): SUNRPC: prevent integer overflow in XDR_QUADLEN() NFSD: harden svcxdr_dupstr() and svcxdr_tmpalloc() against integer overflows fs/nfsd/nfs4xdr.c | 12 ++++++------ include/linux/sunrpc/xdr.h | 3 ++- 2 files changed, 8 insertions(+), 7 deletions(-) -- 2.43.0