[patch] ncpfs: add a sanity check in ncp_is_nfs_extras()

From: Dan Carpenter
Date: Sat Sep 28 2013 - 05:40:17 EST

The "volnum" can come from the server and my static checker complains
that we can't trust it. In theory, it could lead to an info leak but
in real life, it is unlikely.

One way this comes from the server is ncp_obtain_info() initializes
target by calling:

ncp_extract_file_info(ncp_reply_data(server, 0), target);

It then passes target to ncp_obtain_nfs_info() and from there to

Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>

diff --git a/fs/ncpfs/ncplib_kernel.h b/fs/ncpfs/ncplib_kernel.h
index 32c0658..ae08b9f 100644
--- a/fs/ncpfs/ncplib_kernel.h
+++ b/fs/ncpfs/ncplib_kernel.h
@@ -119,6 +119,7 @@ int ncp_create_new(struct inode *dir, struct dentry *dentry,
static inline int ncp_is_nfs_extras(struct ncp_server* server, unsigned int volnum) {
return (server->m.flags & NCP_MOUNT_NFS_EXTRAS) &&
+ (volnum < ARRAY_SIZE(server->name_space)) &&
(server->name_space[volnum] == NW_NS_NFS);
return 0;
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/