From: Kinglong Mee <kinglongmee@gmail.com>
Date: Thu, 24 Sep 2015 12:58:16 +0000 (+0800)
Subject: NFS: Fix bad checking of max taglen in callback request
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=403889c0399c01a12877e3736ae1e96c9ded27be;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git

NFS: Fix bad checking of max taglen in callback request

The taglen should be checked with CB_OP_TAGLEN_MAXSZ directly.

Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
---

diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 9f0f0f646eaf..4ad39fe203f7 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -159,7 +159,7 @@ static __be32 decode_compound_hdr_arg(struct xdr_stream *xdr, struct cb_compound
 	if (unlikely(status != 0))
 		return status;
 	/* We do not like overly long tags! */
-	if (hdr->taglen > CB_OP_TAGLEN_MAXSZ - 12) {
+	if (hdr->taglen > CB_OP_TAGLEN_MAXSZ) {
 		printk("NFS: NFSv4 CALLBACK %s: client sent tag of length %u\n",
 				__func__, hdr->taglen);
 		return htonl(NFS4ERR_RESOURCE);