lkml.org 
[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 171/178] SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
    Date
    From: Chuck Lever <chuck.lever@oracle.com>

    commit 89a3c9f5b9f0bcaa9aea3e8b2a616fcaea9aad78 upstream.

    @subbuf is an output parameter of xdr_buf_subsegment(). A survey of
    call sites shows that @subbuf is always uninitialized before
    xdr_buf_segment() is invoked by callers.

    There are some execution paths through xdr_buf_subsegment() that do
    not set all of the fields in @subbuf, leaving some pointer fields
    containing garbage addresses. Subsequent processing of that buffer
    then results in a page fault.

    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/sunrpc/xdr.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
    index 451ca7ec321c0..7ef37054071f8 100644
    --- a/net/sunrpc/xdr.c
    +++ b/net/sunrpc/xdr.c
    @@ -1118,6 +1118,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
    base = 0;
    } else {
    base -= buf->head[0].iov_len;
    + subbuf->head[0].iov_base = buf->head[0].iov_base;
    subbuf->head[0].iov_len = 0;
    }

    @@ -1130,6 +1131,8 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
    base = 0;
    } else {
    base -= buf->page_len;
    + subbuf->pages = buf->pages;
    + subbuf->page_base = 0;
    subbuf->page_len = 0;
    }

    @@ -1141,6 +1144,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
    base = 0;
    } else {
    base -= buf->tail[0].iov_len;
    + subbuf->tail[0].iov_base = buf->tail[0].iov_base;
    subbuf->tail[0].iov_len = 0;
    }

    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-29 21:49    [W:4.165 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site