mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 14:44:12 +00:00
SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
@subbuf is an output parameter of xdr_buf_subsegment(). A survey of call sites shows that @subbuf is always uninitialized before xdr_buf_segment() is invoked by callers. There are some execution paths through xdr_buf_subsegment() that do not set all of the fields in @subbuf, leaving some pointer fields containing garbage addresses. Subsequent processing of that buffer then results in a page fault. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
This commit is contained in:
parent
d03727b248
commit
89a3c9f5b9
1 changed files with 4 additions and 0 deletions
|
@ -1118,6 +1118,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
|
||||||
base = 0;
|
base = 0;
|
||||||
} else {
|
} else {
|
||||||
base -= buf->head[0].iov_len;
|
base -= buf->head[0].iov_len;
|
||||||
|
subbuf->head[0].iov_base = buf->head[0].iov_base;
|
||||||
subbuf->head[0].iov_len = 0;
|
subbuf->head[0].iov_len = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -1130,6 +1131,8 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
|
||||||
base = 0;
|
base = 0;
|
||||||
} else {
|
} else {
|
||||||
base -= buf->page_len;
|
base -= buf->page_len;
|
||||||
|
subbuf->pages = buf->pages;
|
||||||
|
subbuf->page_base = 0;
|
||||||
subbuf->page_len = 0;
|
subbuf->page_len = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -1141,6 +1144,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
|
||||||
base = 0;
|
base = 0;
|
||||||
} else {
|
} else {
|
||||||
base -= buf->tail[0].iov_len;
|
base -= buf->tail[0].iov_len;
|
||||||
|
subbuf->tail[0].iov_base = buf->tail[0].iov_base;
|
||||||
subbuf->tail[0].iov_len = 0;
|
subbuf->tail[0].iov_len = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue