summaryrefslogtreecommitdiff
path: root/include/linux/sunrpc/xdr.h
diff options
context:
space:
mode:
authorTrond Myklebust <Trond.Myklebust@netapp.com>2012-06-20 17:58:35 +0400
committerTrond Myklebust <Trond.Myklebust@netapp.com>2012-06-29 01:20:41 +0400
commitbfeea1dc1c9238f9e5a17a265489ecd0d19f66bb (patch)
tree009163b2f4c0255599d3c781a833c2dcfaa621ed /include/linux/sunrpc/xdr.h
parent1537693ceaa8d6484f1ce631bec85658bfa9816c (diff)
downloadlinux-bfeea1dc1c9238f9e5a17a265489ecd0d19f66bb.tar.xz
SUNRPC: Don't decode beyond the end of the RPC reply message
Now that xdr_inline_decode() will automatically cross into the page buffers, we need to ensure that it doesn't exceed the total reply message length. This patch sets up a counter that tracks the number of words remaining in the reply message, and ensures that xdr_inline_decode, xdr_read_pages and xdr_enter_page respect the end of message boundary. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'include/linux/sunrpc/xdr.h')
-rw-r--r--include/linux/sunrpc/xdr.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
index af70af333546..f1e7f884d1c3 100644
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -205,6 +205,7 @@ struct xdr_stream {
struct kvec *iov; /* pointer to the current kvec */
struct kvec scratch; /* Scratch buffer */
struct page **page_ptr; /* pointer to the current page */
+ unsigned int nwords; /* Remaining decode buffer length */
};
/*