diff options
Diffstat (limited to 'fs/nfsd/nfsxdr.c')
-rw-r--r-- | fs/nfsd/nfsxdr.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c index 79d964aa8079..bf913201a6ad 100644 --- a/fs/nfsd/nfsxdr.c +++ b/fs/nfsd/nfsxdr.c | |||
@@ -280,6 +280,7 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, | |||
280 | struct nfsd_writeargs *args) | 280 | struct nfsd_writeargs *args) |
281 | { | 281 | { |
282 | unsigned int len, hdr, dlen; | 282 | unsigned int len, hdr, dlen; |
283 | struct kvec *head = rqstp->rq_arg.head; | ||
283 | int v; | 284 | int v; |
284 | 285 | ||
285 | p = decode_fh(p, &args->fh); | 286 | p = decode_fh(p, &args->fh); |
@@ -300,9 +301,10 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, | |||
300 | * Check to make sure that we got the right number of | 301 | * Check to make sure that we got the right number of |
301 | * bytes. | 302 | * bytes. |
302 | */ | 303 | */ |
303 | hdr = (void*)p - rqstp->rq_arg.head[0].iov_base; | 304 | hdr = (void*)p - head->iov_base; |
304 | dlen = rqstp->rq_arg.head[0].iov_len + rqstp->rq_arg.page_len | 305 | if (hdr > head->iov_len) |
305 | - hdr; | 306 | return 0; |
307 | dlen = head->iov_len + rqstp->rq_arg.page_len - hdr; | ||
306 | 308 | ||
307 | /* | 309 | /* |
308 | * Round the length of the data which was specified up to | 310 | * Round the length of the data which was specified up to |
@@ -316,7 +318,7 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, | |||
316 | return 0; | 318 | return 0; |
317 | 319 | ||
318 | rqstp->rq_vec[0].iov_base = (void*)p; | 320 | rqstp->rq_vec[0].iov_base = (void*)p; |
319 | rqstp->rq_vec[0].iov_len = rqstp->rq_arg.head[0].iov_len - hdr; | 321 | rqstp->rq_vec[0].iov_len = head->iov_len - hdr; |
320 | v = 0; | 322 | v = 0; |
321 | while (len > rqstp->rq_vec[v].iov_len) { | 323 | while (len > rqstp->rq_vec[v].iov_len) { |
322 | len -= rqstp->rq_vec[v].iov_len; | 324 | len -= rqstp->rq_vec[v].iov_len; |