diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2014-11-27 18:58:54 +0300 |
|---|---|---|
| committer |   J. Bruce Fields <bfields@redhat.com> | 2014-12-01 12:45:28 -0700 |
| commit | 818f2f57f20d0e9a9294180f304f34cd4e8f6066 (patch) | |
| tree | ba82e5a7af67db82e583a8d36176c3f3e3e105ab /fs/nfsd | |
| parent | sunrpc: release svc_pool_map reference when serv allocation fails (diff) | |
| download | linux-dev-818f2f57f20d0e9a9294180f304f34cd4e8f6066.tar.xz linux-dev-818f2f57f20d0e9a9294180f304f34cd4e8f6066.zip | |
nfsd: minor off by one checks in __write_versions()
My static checker complains that if "len == remaining" then it means we
have truncated the last character off the version string.
The intent of the code is that we print as many versions as we can
without truncating a version. Then we put a newline at the end. If the
newline can't fit we return -EINVAL.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jeff Layton <jlayton@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'fs/nfsd')
| -rw-r--r-- | fs/nfsd/nfsctl.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index ca73ca79a0ee..0079b28270e9 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -606,7 +606,7 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size) num); sep = " "; - if (len > remaining) + if (len >= remaining) break; remaining -= len; buf += len; @@ -621,7 +621,7 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size) '+' : '-', minor); - if (len > remaining) + if (len >= remaining) break; remaining -= len; buf += len; @@ -629,7 +629,7 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size) } len = snprintf(buf, remaining, "\n"); - if (len > remaining) + if (len >= remaining) return -EINVAL; return tlen + len; } |