nfsd4: memory corruption in numeric_name_to_id()
Subsystems (3)
PATCH 1/1 nfsd4: memory corruption in numeric_name_to_id()
"id" is type is a uid_t (32 bits) but on 64 bit systems strict_strtoul() modifies 64 bits of data. We should use kstrtouint() instead.
Signed-off-by Dan Carpenter <[email protected]>
fs/nfsd/nfs4idmap.c +1 -1
@@ -581,7 +581,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel/* Just to make sure it's null-terminated: */ memcpy (buf, name, namelen); buf[namelen] ='\0' ; - ret =strict_strtoul (name,10 , (unsigned long *)id); + ret =kstrtouint (name,10 , id);return ret =0 ; }
Quoted 2 lines · Dan Carpenter
"id" is type is a
uid_t(32 bits) but on 64 bit systemsstrict_strtoul()modifies 64 bits of data. We should usekstrtouint()instead.
Whoops--thanks, applied!
--b.
Quoted 16 lines
Signed-off-by Dan Carpenter <[email protected]>fs/nfsd/nfs4idmap.c +1
-1@@ -581,7 +581,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel/* Just to make sure it's null-terminated: */ memcpy (buf, name, namelen); buf[namelen] ='\0' ; - ret =strict_strtoul (name,10 , (unsigned long *)id); + ret =kstrtouint (name,10 , id);return ret =0 ; }