mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-12-27 10:01:39 -05:00
Code Issues Packages Projects Releases Wiki Activity

svcrdma: bound check rq_pages index in inline path

Browse Source 
svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without
verifying rc_curpage stays within the allocated page array. Add guards
before the first use and after advancing to a new page.

Fixes: d7cc739726 ("svcrdma: support multiple Read chunks per RPC")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
This commit is contained in:
Joshua Rogers
2025-11-07 10:09:49 -05:00
committed by Chuck Lever
parent 94972027ab
commit d1bea0ce35
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
net/sunrpc/xprtrdma/svc_rdma_rw.c
View File

@@ -841,6 +841,9 @@ static int svc_rdma_copy_inline_range(struct svc_rqst *rqstp,
for (page_no = 0; page_no < numpages; page_no++) {
unsigned int page_len;
if (head->rc_curpage >= rqstp->rq_maxpages)
return -EINVAL;
page_len = min_t(unsigned int, remaining,
PAGE_SIZE - head->rc_pageoff);