diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2022-06-01 19:46:52 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-06-14 19:45:04 +0300 |
| commit | 659f7568e09593945c221bf20217a82ebdfe1328 (patch) | |
| tree | 760ee991acb3e665e09439f87d81e8f6ff69a4a6 | |
| parent | 333dcc94ebf53f79f3dc0e7a7c16700bc7ff7e57 (diff) | |
| download | linux-659f7568e09593945c221bf20217a82ebdfe1328.tar.xz | |
SUNRPC: Trap RDMA segment overflows
[ Upstream commit f012e95b377c73c0283f009823c633104dedb337 ]
Prevent svc_rdma_build_writes() from walking off the end of a Write
chunk's segment array. Caught with KASAN.
The test that this fix replaces is invalid, and might have been left
over from an earlier prototype of the PCL work.
Fixes: 7a1cbfa18059 ("svcrdma: Use parsed chunk lists to construct RDMA Writes")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/sunrpc/xprtrdma/svc_rdma_rw.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c index 5f0155fdefc7..11cf7c646644 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c @@ -478,10 +478,10 @@ svc_rdma_build_writes(struct svc_rdma_write_info *info, unsigned int write_len; u64 offset; - seg = &info->wi_chunk->ch_segments[info->wi_seg_no]; - if (!seg) + if (info->wi_seg_no >= info->wi_chunk->ch_segcount) goto out_overflow; + seg = &info->wi_chunk->ch_segments[info->wi_seg_no]; write_len = min(remaining, seg->rs_length - info->wi_seg_off); if (!write_len) goto out_overflow; |