Skip to content

Commit

Permalink
SUNRPC: stop printk reading past end of string
Browse files Browse the repository at this point in the history
[ Upstream commit 8c6b6c793ed32b8f9770ebcdf1ba99af423c303b ]

Since p points at raw xdr data, there's no guarantee that it's NULL
terminated, so we should give a length.  And probably escape any special
characters too.

Reported-by: Zhi Li <[email protected]>
Signed-off-by: J. Bruce Fields <[email protected]>
Signed-off-by: Trond Myklebust <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
  • Loading branch information
J. Bruce Fields authored and gregkh committed Sep 23, 2020
1 parent 213fe77 commit a306c34
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions net/sunrpc/rpcb_clnt.c
Original file line number Diff line number Diff line change
Expand Up @@ -975,8 +975,8 @@ static int rpcb_dec_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr,
p = xdr_inline_decode(xdr, len);
if (unlikely(p == NULL))
goto out_fail;
dprintk("RPC: %5u RPCB_%s reply: %s\n", req->rq_task->tk_pid,
req->rq_task->tk_msg.rpc_proc->p_name, (char *)p);
dprintk("RPC: %5u RPCB_%s reply: %*pE\n", req->rq_task->tk_pid,
req->rq_task->tk_msg.rpc_proc->p_name, len, (char *)p);

if (rpc_uaddr2sockaddr(req->rq_xprt->xprt_net, (char *)p, len,
sap, sizeof(address)) == 0)
Expand Down

0 comments on commit a306c34

Please sign in to comment.