Commit f012e95b authored Jun 01, 2022 by Chuck Lever

SUNRPC: Trap RDMA segment overflows



Prevent svc_rdma_build_writes() from walking off the end of a Write
chunk's segment array. Caught with KASAN.

The test that this fix replaces is invalid, and might have been left
over from an earlier prototype of the PCL work.

Fixes: 7a1cbfa1 ("svcrdma: Use parsed chunk lists to construct RDMA Writes")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

parent b6c71c66

net/sunrpc/xprtrdma/svc_rdma_rw.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -478,10 +478,10 @@ svc_rdma_build_writes(struct svc_rdma_write_info *info,
		unsigned int write_len;
		u64 offset;

		seg = &info->wi_chunk->ch_segments[info->wi_seg_no];
		if (!seg)
		if (info->wi_seg_no >= info->wi_chunk->ch_segcount)
		goto out_overflow;

		seg = &info->wi_chunk->ch_segments[info->wi_seg_no];
		write_len = min(remaining, seg->rs_length - info->wi_seg_off);
		if (!write_len)
		goto out_overflow;