Commit d1bea0ce authored by Joshua Rogers's avatar Joshua Rogers Committed by Chuck Lever
Browse files

svcrdma: bound check rq_pages index in inline path 



svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without
verifying rc_curpage stays within the allocated page array. Add guards
before the first use and after advancing to a new page.

Fixes: d7cc7397 ("svcrdma: support multiple Read chunks per RPC")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJoshua Rogers <linux@joshua.hu>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 94972027

net/sunrpc/xprtrdma/svc_rdma_rw.c

+3 −0
Original line number Diff line number Diff line
@@ -841,6 +841,9 @@ static int svc_rdma_copy_inline_range(struct svc_rqst *rqstp, 
	for (page_no = 0; page_no < numpages; page_no++) {

		unsigned int page_len;



		if (head->rc_curpage >= rqstp->rq_maxpages)

			return -EINVAL;



		page_len = min_t(unsigned int, remaining,

				 PAGE_SIZE - head->rc_pageoff);