diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2020-06-25 11:32:34 -0400 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2020-06-29 20:08:04 -0400 |
| commit | 8deec224e90e09613a43e00124b719b26349714d (patch) | |
| tree | ccc573ce50ae81b96cc6d9fd977eabe6cc7f61c1 /fs | |
| parent | d6f775f682e255b278868f11e806e6681de506cd (diff) | |
| download | linux-stable-8deec224e90e09613a43e00124b719b26349714d.tar.gz linux-stable-8deec224e90e09613a43e00124b719b26349714d.tar.bz2 linux-stable-8deec224e90e09613a43e00124b719b26349714d.zip | |
SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
commit 89a3c9f5b9f0bcaa9aea3e8b2a616fcaea9aad78 upstream.
@subbuf is an output parameter of xdr_buf_subsegment(). A survey of
call sites shows that @subbuf is always uninitialized before
xdr_buf_segment() is invoked by callers.
There are some execution paths through xdr_buf_subsegment() that do
not set all of the fields in @subbuf, leaving some pointer fields
containing garbage addresses. Subsequent processing of that buffer
then results in a page fault.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
0 files changed, 0 insertions, 0 deletions