NFSD: Stricter buffer size checking in write_recoverydir()

While it's not likely a pathname will be longer than SIMPLE_TRANSACTION_SIZE, we should be more careful about just plopping it into the output buffer without bounds checking. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>

NFSD: Stricter buffer size checking in write_recoverydir()
While it's not likely a pathname will be longer than SIMPLE_TRANSACTION_SIZE, we should be more careful about just plopping it into the output buffer without bounds checking. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Chuck Lever · J. Bruce Fields
1 parent 017cb47f46
Showing 1 changed file with 3 additions and 2 deletions Side-by-side Diff
fs/nfsd/nfsctl.c
@@ -1260,8 +1260,9 @@
  
 		status = nfs4_reset_recoverydir(recdir);
 	}
-	sprintf(buf, "%s\n", nfs4_recoverydir());
-	return strlen(buf);
+
+	return scnprintf(buf, SIMPLE_TRANSACTION_LIMIT, "%s\n",
+							nfs4_recoverydir());
 }
  
 /**
...	...	@@ -1260,8 +1260,9 @@
1260	1260
1261	1261	status = nfs4_reset_recoverydir(recdir);
1262	1262	}
1263		- sprintf(buf, "%s\n", nfs4_recoverydir());
1264		- return strlen(buf);
	1263	+
	1264	+ return scnprintf(buf, SIMPLE_TRANSACTION_LIMIT, "%s\n",
	1265	+ nfs4_recoverydir());
1265	1266	}
1266	1267
1267	1268	/**