Vinícius Ferrão has uploaded this change for review.
LAYOUTRETURN: fix argument size with no pending recall (#1411)
nfs4_return_one_state() sizes its argument as the struct plus
recalls - 1 cookies. With no recall pending, recalls - 1 wraps, and
the memset writes past the allocation. With _FORTIFY_SOURCE=3, ganesha
aborts on every LAYOUTRETURN, including returns on close. Size it for
the struct alone in that case.
Reported-by: Aelindra (GitHub)
GitHub Issue: #1411
Change-Id: Icd418c230ce9218e92a1acb959a6b6e843fb749c
Signed-off-by: Vinícius Ferrão <ferrao@versatushpc.com.br>
---
M src/Protocols/NFS/nfs4_op_layoutreturn.c
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/72/1255672/1
To view, visit change 1255672. To unsubscribe, or for help writing mail filters, visit settings.