xprtrdma: Fix XDRBUF_SPARSE_PAGES support
authorChuck Lever <chuck.lever@oracle.com>
Tue, 8 Dec 2020 23:29:02 +0000 (18:29 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 30 Dec 2020 10:54:15 +0000 (11:54 +0100)
commit35f71f3cbd7d09dbc77764a3694bb0080ee0cb61
tree39061c3bdd7b20f110b32addb93cbfcda84666dc
parent6a9a98fdd45ed4daf2d99ba7ba168f2850ddbe38
xprtrdma: Fix XDRBUF_SPARSE_PAGES support

commit 15261b9126cd5bb2ad8521da49d8f5c042d904c7 upstream.

Olga K. observed that rpcrdma_marsh_req() allocates sparse pages
only when it has determined that a Reply chunk is necessary. There
are plenty of cases where no Reply chunk is needed, but the
XDRBUF_SPARSE_PAGES flag is set. The result would be a crash in
rpcrdma_inline_fixup() when it tries to copy parts of the received
Reply into a missing page.

To avoid crashing, handle sparse page allocation up front.

Until XATTR support was added, this issue did not appear often
because the only SPARSE_PAGES consumer always expected a reply large
enough to always require a Reply chunk.

Reported-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/sunrpc/xprtrdma/rpc_rdma.c