Messages in this thread Patch in this message | | | From | braam@cs ... | Date | Tue, 02 Nov 1999 11:19:42 -0700 | Subject | NFS_ROOT bug |
| |
Hi,
I came across a small bug in the NFS root mount_clnt implementation. The buffer size in the RPC call structure is not correctly set - worse is that a rogue pointer (the result size) is entered at the "call count" spot.
Here is a tiny patch.
- Peter ---- fs/nfs/mount_clnt.c.orig Tue Nov 2 12:05:36 1999 +++ fs/nfs/mount_clnt.c Tue Nov 2 12:15:00 1999 @@ -23,6 +23,11 @@ # define NFSDBG_FACILITY NFSDBG_ROOT #endif +#ifndef MAX +# define MAX(a, b) (((a) > (b))? (a) : (b)) +#endif + + /* #define MOUNT_PROGRAM 100005 #define MOUNT_VERSION 1 @@ -119,7 +124,7 @@ { "mnt_mount", (kxdrproc_t) xdr_encode_dirpath, (kxdrproc_t) xdr_decode_fhstatus, - MNT_dirpath_sz, MNT_fhstatus_sz }, + MAX(MNT_dirpath_sz, MNT_fhstatus_sz), 0}, }; static struct rpc_version mnt_version1 = { | |