lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 223/862] SUNRPC: Fix svcxdr_init_encodes buflen calculation
    Date
    From: Chuck Lever <chuck.lever@oracle.com>

    [ Upstream commit 1242a87da0d8cd2a428e96ca68e7ea899b0f4624 ]

    Commit 2825a7f90753 ("nfsd4: allow encoding across page boundaries")
    added an explicit computation of the remaining length in the rq_res
    XDR buffer.

    The computation appears to suffer from an "off-by-one" bug. Because
    buflen is too large by one page, XDR encoding can run off the end of
    the send buffer by eventually trying to use the struct page address
    in rq_page_end, which always contains NULL.

    Fixes: bddfdbcddbe2 ("NFSD: Extract the svcxdr_init_encode() helper")
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/linux/sunrpc/svc.h | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
    index 5a830b66f059..0ca8a8ffb47e 100644
    --- a/include/linux/sunrpc/svc.h
    +++ b/include/linux/sunrpc/svc.h
    @@ -587,7 +587,7 @@ static inline void svcxdr_init_encode(struct svc_rqst *rqstp)
    xdr->end = resv->iov_base + PAGE_SIZE - rqstp->rq_auth_slack;
    buf->len = resv->iov_len;
    xdr->page_ptr = buf->pages - 1;
    - buf->buflen = PAGE_SIZE * (1 + rqstp->rq_page_end - buf->pages);
    + buf->buflen = PAGE_SIZE * (rqstp->rq_page_end - buf->pages);
    buf->buflen -= rqstp->rq_auth_slack;
    xdr->rqst = NULL;
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-19 11:09    [W:4.030 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site