Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()

It's only current caller already length-checks the string, but let's
be safe.

Fixes: 0964a3d3f1aa ("[PATCH] knfsd: nfsd4 reboot dirname fix")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

+2 -1
+2 -1
fs/nfsd/nfs4recover.c
··· 659 659 return status; 660 660 status = -ENOTDIR; 661 661 if (d_is_dir(path.dentry)) { 662 - strcpy(user_recovery_dirname, recdir); 662 + strscpy(user_recovery_dirname, recdir, 663 + sizeof(user_recovery_dirname)); 663 664 status = 0; 664 665 } 665 666 path_put(&path);