projects
/
platform
/
kernel
/
linux-rpi.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
b650545
)
svcrdma: Catch another Reply chunk overflow case
author
Chuck Lever
<chuck.lever@oracle.com>
Thu, 12 Nov 2020 19:47:14 +0000
(14:47 -0500)
committer
Chuck Lever
<chuck.lever@oracle.com>
Mon, 30 Nov 2020 18:00:21 +0000
(13:00 -0500)
When space in the Reply chunk runs out in the middle of a segment,
we end up passing a zero-length SGL to rdma_rw_ctx_init(), and it
oopses.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
net/sunrpc/xprtrdma/svc_rdma_rw.c
patch
|
blob
|
history
diff --git
a/net/sunrpc/xprtrdma/svc_rdma_rw.c
b/net/sunrpc/xprtrdma/svc_rdma_rw.c
index
80a0c0e
..
7c50edd
100644
(file)
--- a/
net/sunrpc/xprtrdma/svc_rdma_rw.c
+++ b/
net/sunrpc/xprtrdma/svc_rdma_rw.c
@@
-460,6
+460,8
@@
svc_rdma_build_writes(struct svc_rdma_write_info *info,
offset += info->wi_seg_off;
write_len = min(remaining, length - info->wi_seg_off);
+ if (!write_len)
+ goto out_overflow;
ctxt = svc_rdma_get_rw_ctxt(rdma,
(write_len >> PAGE_SHIFT) + 2);
if (!ctxt)