From: Chuck Lever Date: Thu, 12 Nov 2020 19:47:14 +0000 (-0500) Subject: svcrdma: Catch another Reply chunk overflow case X-Git-Tag: accepted/tizen/unified/20230118.172025~8293^2~130 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e5decb2eb5f4d1f64ba9196b4bad0e26a441c81c;p=platform%2Fkernel%2Flinux-rpi.git svcrdma: Catch another Reply chunk overflow case When space in the Reply chunk runs out in the middle of a segment, we end up passing a zero-length SGL to rdma_rw_ctx_init(), and it oopses. Signed-off-by: Chuck Lever --- diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c index 80a0c0e..7c50edd 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c @@ -460,6 +460,8 @@ svc_rdma_build_writes(struct svc_rdma_write_info *info, offset += info->wi_seg_off; write_len = min(remaining, length - info->wi_seg_off); + if (!write_len) + goto out_overflow; ctxt = svc_rdma_get_rw_ctxt(rdma, (write_len >> PAGE_SHIFT) + 2); if (!ctxt)