SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
authorChuck Lever <chuck.lever@oracle.com>
Thu, 25 Jun 2020 15:32:34 +0000 (11:32 -0400)
committerSasha Levin <sashal@kernel.org>
Tue, 30 Jun 2020 19:38:45 +0000 (15:38 -0400)
commita20cecece4c3fd6d9a11a221a4f183585e14ce70
tree62ba95136a16ed2a1fc9ef65468c974095d52cb9
parent04e6e060f07300f7a28c563b30d2cc430a0d9035
SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()

commit 89a3c9f5b9f0bcaa9aea3e8b2a616fcaea9aad78 upstream.

@subbuf is an output parameter of xdr_buf_subsegment(). A survey of
call sites shows that @subbuf is always uninitialized before
xdr_buf_segment() is invoked by callers.

There are some execution paths through xdr_buf_subsegment() that do
not set all of the fields in @subbuf, leaving some pointer fields
containing garbage addresses. Subsequent processing of that buffer
then results in a page fault.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/sunrpc/xdr.c