shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 19:30:30 +09:00
Code Issues Packages Projects Releases Wiki Activity

SUNRPC: Trap RDMA segment overflows

Browse Source 
[ Upstream commit f012e95b37 ]

Prevent svc_rdma_build_writes() from walking off the end of a Write
chunk's segment array. Caught with KASAN.

The test that this fix replaces is invalid, and might have been left
over from an earlier prototype of the PCL work.

Fixes: 7a1cbfa180 ("svcrdma: Use parsed chunk lists to construct RDMA Writes")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Chuck Lever
2022-06-01 12:46:52 -04:00
committed by Greg Kroah-Hartman
parent 7a60594efd
commit ea26bf5eca
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
net/sunrpc/xprtrdma/svc_rdma_rw.c
View File

@@ -456,10 +456,10 @@ svc_rdma_build_writes(struct svc_rdma_write_info *info,
unsigned int write_len;
u64 offset;
seg = &info->wi_chunk->ch_segments[info->wi_seg_no];
if (!seg)
if (info->wi_seg_no >= info->wi_chunk->ch_segcount)
goto out_overflow;
seg = &info->wi_chunk->ch_segments[info->wi_seg_no];
write_len = min(remaining, seg->rs_length - info->wi_seg_off);
if (!write_len)
goto out_overflow;