We fixed expkey_parse() in b2ea70afad "nfsd: Fix oops when parsing a
0 length export" but there are other cache_parse() implimentations
which have the same issue.
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
---
Since half of the implimentations get this wrong, maybe we should
just check for this in cache_do_downcall(). Is there ever a valid
reason to pass a zero length string to cache_parse()?
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index cf8a6bd..1d147a8 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -496,7 +496,7 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
struct svc_export exp = {}, *expp;
int an_int;
- if (mesg[mlen-1] != '\n')
+ if (mlen < 1 || mesg[mlen - 1] != '\n')
return -EINVAL;
mesg[mlen-1] = 0;
diff --git a/fs/nfs/dns_resolve.c b/fs/nfs/dns_resolve.c
index a6e711a..d945d71 100644
--- a/fs/nfs/dns_resolve.c
+++ b/fs/nfs/dns_resolve.c
@@ -217,7 +217,7 @@ static int nfs_dns_parse(struct cache_detail *cd, char *buf, int buflen)
ssize_t len;
int ret = -EINVAL;
- if (buf[buflen-1] != '\n')
+ if (buflen < 1 || buf[buflen - 1] != '\n')
goto out;
buf[buflen-1] = '\0';
diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
index 9409627..f8456a4 100644
--- a/fs/nfsd/nfs4idmap.c
+++ b/fs/nfsd/nfs4idmap.c
@@ -202,7 +202,7 @@ idtoname_parse(struct cache_detail *cd, char *buf, int buflen)
int len;
int error = -EINVAL;
- if (buf[buflen - 1] != '\n')
+ if (buflen < 1 || buf[buflen - 1] != '\n')
return (-EINVAL);
buf[buflen - 1]= '\0';
@@ -378,7 +378,7 @@ nametoid_parse(struct cache_detail *cd, char *buf, int buflen)
char *buf1;
int error = -EINVAL;
- if (buf[buflen - 1] != '\n')
+ if (buflen < 1 || buf[buflen - 1] != '\n')
return (-EINVAL);
buf[buflen - 1]= '\0';
Attachment:
signature.asc
Description: Digital signature
