mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-20 09:31:09 +00:00
SUNRPC: Trap RDMA segment overflows
[ Upstream commitf012e95b37
] Prevent svc_rdma_build_writes() from walking off the end of a Write chunk's segment array. Caught with KASAN. The test that this fix replaces is invalid, and might have been left over from an earlier prototype of the PCL work. Fixes:7a1cbfa180
("svcrdma: Use parsed chunk lists to construct RDMA Writes") Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
7a60594efd
commit
ea26bf5eca
1 changed files with 2 additions and 2 deletions
|
@ -456,10 +456,10 @@ svc_rdma_build_writes(struct svc_rdma_write_info *info,
|
|||
unsigned int write_len;
|
||||
u64 offset;
|
||||
|
||||
seg = &info->wi_chunk->ch_segments[info->wi_seg_no];
|
||||
if (!seg)
|
||||
if (info->wi_seg_no >= info->wi_chunk->ch_segcount)
|
||||
goto out_overflow;
|
||||
|
||||
seg = &info->wi_chunk->ch_segments[info->wi_seg_no];
|
||||
write_len = min(remaining, seg->rs_length - info->wi_seg_off);
|
||||
if (!write_len)
|
||||
goto out_overflow;
|
||||
|
|
Loading…
Reference in a new issue