From 16b20ca8f95a5fee56aadd972cbcbecd0ded23a0 Mon Sep 17 00:00:00 2001 From: "J. Bruce Fields" Date: Sun, 11 Nov 2007 15:43:12 -0500 Subject: [PATCH] --- yaml --- r: 82416 b: refs/heads/master c: ca2a05aa7c72309ee65164c78fa2be7a5038215e h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/fs/nfsd/nfs4xdr.c | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/[refs] b/[refs] index 981abf02a1f5..b3e66157e138 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: a490c681cbcf65d548138c377bb691c85824d323 +refs/heads/master: ca2a05aa7c72309ee65164c78fa2be7a5038215e diff --git a/trunk/fs/nfsd/nfs4xdr.c b/trunk/fs/nfsd/nfs4xdr.c index 57333944af7f..bf1e792a65a0 100644 --- a/trunk/fs/nfsd/nfs4xdr.c +++ b/trunk/fs/nfsd/nfs4xdr.c @@ -148,12 +148,12 @@ xdr_error: \ } \ } while (0) -static __be32 *read_buf(struct nfsd4_compoundargs *argp, int nbytes) +static __be32 *read_buf(struct nfsd4_compoundargs *argp, u32 nbytes) { /* We want more bytes than seem to be available. * Maybe we need a new page, maybe we have just run out */ - int avail = (char*)argp->end - (char*)argp->p; + unsigned int avail = (char *)argp->end - (char *)argp->p; __be32 *p; if (avail + argp->pagelen < nbytes) return NULL; @@ -169,6 +169,11 @@ static __be32 *read_buf(struct nfsd4_compoundargs *argp, int nbytes) return NULL; } + /* + * The following memcpy is safe because read_buf is always + * called with nbytes > avail, and the two cases above both + * guarantee p points to at least nbytes bytes. + */ memcpy(p, argp->p, avail); /* step to next page */ argp->p = page_address(argp->pagelist[0]);