From: NeilBrown Date: Mon, 17 Sep 2012 06:46:34 +0000 (+1000) Subject: NFS4: avoid underflow when converting error to pointer. X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=62d98c935456ee121b03d6a68aa3091a04085b7e;p=GitHub%2Fmt8127%2Fandroid_kernel_alcatel_ttab.git NFS4: avoid underflow when converting error to pointer. In nfs4_create_sec_client, 'flavor' can hold a negative error code (returned from nfs4_negotiate_security), even though it is an 'enum' and hence unsigned. The code is careful to cast it to an (int) before testing if it is negative, however it doesn't cast to an (int) before calling ERR_PTR. On a machine where "void*" is larger than "int", this results in the unsigned equivalent of -1 (e.g. 0xffffffff) being converted to a pointer. Subsequent code determines that this is not negative, and so dereferences it with predictable results. So: cast 'flavor' to a (signed) int before passing to ERR_PTR. cc: Benny Halevy Signed-off-by: NeilBrown Signed-off-by: Trond Myklebust --- diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c index 398d5fd74157..4fdeb1b7042e 100644 --- a/fs/nfs/nfs4namespace.c +++ b/fs/nfs/nfs4namespace.c @@ -198,7 +198,7 @@ struct rpc_clnt *nfs4_create_sec_client(struct rpc_clnt *clnt, struct inode *ino flavor = nfs4_negotiate_security(inode, name); if ((int)flavor < 0) - return ERR_PTR(flavor); + return ERR_PTR((int)flavor); clone = rpc_clone_client(clnt); if (IS_ERR(clone))