tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

SUNRPC: Fix READ_PLUS crasher

Looks like there are still cases when "space_left - frag1bytes" can
legitimately exceed PAGE_SIZE. Ensure that xdr->end always remains
within the current encode buffer.

Reported-by: Bruce Fields <bfields@fieldses.org>
Reported-by: Zorro Lang <zlang@redhat.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216151
Fixes: 6c254bf3b637 ("SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

Chuck Lever a23dd544 8a9ffb8c

options
unified split
Changed files
+1 -1
net
sunrpc
xdr.c
+1 -1
net/sunrpc/xdr.c
··· 984 984 p = page_address(*xdr->page_ptr); 985 985 xdr->p = p + frag2bytes; 986 986 space_left = xdr->buf->buflen - xdr->buf->len; 987 - if (space_left - nbytes >= PAGE_SIZE) 987 + if (space_left - frag1bytes >= PAGE_SIZE) 988 988 xdr->end = p + PAGE_SIZE; 989 989 else 990 990 xdr->end = p + space_left - frag1bytes;