net: nfs: fix the regression when nfs_read_reply() is called
authorJaehoon Chung <jh80.chung@samsung.com>
Mon, 10 Apr 2017 10:39:51 +0000 (19:39 +0900)
committerJaehoon Chung <jh80.chung@samsung.com>
Tue, 20 Oct 2020 01:35:21 +0000 (10:35 +0900)
When nfs_read_reply() is called, it should be stucked in memcpy().
size of rpc_pkt.u.reply() might be too bigger.
Change from 'sizeof(rpc_pkt.u.reply)' to 'len'.

Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
net/nfs.c

index 70d0e08..c6c400b 100644 (file)
--- a/net/nfs.c
+++ b/net/nfs.c
@@ -672,7 +672,7 @@ static int nfs_read_reply(uchar *pkt, unsigned len)
 
        debug("%s\n", __func__);
 
-       memcpy(&rpc_pkt.u.data[0], pkt, sizeof(rpc_pkt.u.reply));
+       memcpy(&rpc_pkt.u.data[0], pkt, len);
 
        if (ntohl(rpc_pkt.u.reply.id) > rpc_id)
                return -NFS_RPC_ERR;