diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2020-11-12 22:47:14 +0300 |
|---|---|---|
| committer | Chuck Lever <chuck.lever@oracle.com> | 2020-11-30 21:00:21 +0300 |
| commit | e5decb2eb5f4d1f64ba9196b4bad0e26a441c81c (patch) | |
| tree | 0baa22932c40c059e733862707fc307ec272c736 /net/sunrpc/xprtrdma | |
| parent | b65054597872ce3aefbc6a666385eabdf9e288da (diff) | |
| download | linux-e5decb2eb5f4d1f64ba9196b4bad0e26a441c81c.tar.xz | |
svcrdma: Catch another Reply chunk overflow case
When space in the Reply chunk runs out in the middle of a segment,
we end up passing a zero-length SGL to rdma_rw_ctx_init(), and it
oopses.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Diffstat (limited to 'net/sunrpc/xprtrdma')
| -rw-r--r-- | net/sunrpc/xprtrdma/svc_rdma_rw.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c index 80a0c0e87590..7c50eddb8d3c 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c @@ -460,6 +460,8 @@ svc_rdma_build_writes(struct svc_rdma_write_info *info, offset += info->wi_seg_off; write_len = min(remaining, length - info->wi_seg_off); + if (!write_len) + goto out_overflow; ctxt = svc_rdma_get_rw_ctxt(rdma, (write_len >> PAGE_SHIFT) + 2); if (!ctxt) |