diff options
| author | Joshua Rogers <linux@joshua.hu> | 2025-11-07 10:09:49 -0500 |
|---|---|---|
| committer | Chuck Lever <chuck.lever@oracle.com> | 2025-12-08 10:51:26 -0500 |
| commit | d1bea0ce35b6095544ee82bb54156fc62c067e58 (patch) | |
| tree | 3db485ce306e3926e9856ad06a007ab3a4dbea2b | |
| parent | 94972027ab55b200e031059fd6c7a649f8248020 (diff) | |
svcrdma: bound check rq_pages index in inline path
svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without
verifying rc_curpage stays within the allocated page array. Add guards
before the first use and after advancing to a new page.
Fixes: d7cc73972661 ("svcrdma: support multiple Read chunks per RPC")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
| -rw-r--r-- | net/sunrpc/xprtrdma/svc_rdma_rw.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c index e813e5463352..310de7a80be5 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c @@ -841,6 +841,9 @@ static int svc_rdma_copy_inline_range(struct svc_rqst *rqstp, for (page_no = 0; page_no < numpages; page_no++) { unsigned int page_len; + if (head->rc_curpage >= rqstp->rq_maxpages) + return -EINVAL; + page_len = min_t(unsigned int, remaining, PAGE_SIZE - head->rc_pageoff); |