Skip to contentSkip to conversation

nfsd4: memory corruption in numeric_name_to_id()

PATCH In review Dan Carpenter 2 participants 2 messages Mar 28, 2012

Subsystems (3)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 nfsd4: memory corruption in numeric_name_to_id()

"id" is type is a uid_t (32 bits) but on 64 bit systems strict_strtoul() modifies 64 bits of data. We should use kstrtouint() instead.

fs/nfsd/nfs4idmap.c +1 -1
index 69ca9c5..322d11c 100644
@@ -581,7 +581,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel
 	/* Just to make sure it's null-terminated: */
 	memcpy(buf, name, namelen);
 	buf[namelen] = '\0';
-	ret = strict_strtoul(name, 10, (unsigned long *)id);
+	ret = kstrtouint(name, 10, id);
 	return ret = 0;
 }
 
#1 lore raw
Quoted 2 lines · Dan Carpenter

"id" is type is a uid_t (32 bits) but on 64 bit systems strict_strtoul() modifies 64 bits of data. We should use kstrtouint() instead.

Whoops--thanks, applied!

--b.

Quoted 16 lines
fs/nfsd/nfs4idmap.c +1 -1
index 69ca9c5..322d11c 100644
@@ -581,7 +581,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel
 	/* Just to make sure it's null-terminated: */
 	memcpy(buf, name, namelen);
 	buf[namelen] = '\0';
-	ret = strict_strtoul(name, 10, (unsigned long *)id);
+	ret = kstrtouint(name, 10, id);
 	return ret = 0;
 }