lkml.org 
[lkml]   [2022]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 162/298] SUNRPC: Trap RDMA segment overflows
    Date
    From: Chuck Lever <chuck.lever@oracle.com>

    [ Upstream commit f012e95b377c73c0283f009823c633104dedb337 ]

    Prevent svc_rdma_build_writes() from walking off the end of a Write
    chunk's segment array. Caught with KASAN.

    The test that this fix replaces is invalid, and might have been left
    over from an earlier prototype of the PCL work.

    Fixes: 7a1cbfa18059 ("svcrdma: Use parsed chunk lists to construct RDMA Writes")
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/sunrpc/xprtrdma/svc_rdma_rw.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
    index 5f0155fdefc7..11cf7c646644 100644
    --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
    +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
    @@ -478,10 +478,10 @@ svc_rdma_build_writes(struct svc_rdma_write_info *info,
    unsigned int write_len;
    u64 offset;

    - seg = &info->wi_chunk->ch_segments[info->wi_seg_no];
    - if (!seg)
    + if (info->wi_seg_no >= info->wi_chunk->ch_segcount)
    goto out_overflow;

    + seg = &info->wi_chunk->ch_segments[info->wi_seg_no];
    write_len = min(remaining, seg->rs_length - info->wi_seg_off);
    if (!write_len)
    goto out_overflow;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-13 16:32    [W:2.179 / U:0.364 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site