diff options
| author | Chuck Lever <chuck.lever@oracle.com> | 2020-06-25 11:32:34 -0400 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2020-06-30 15:37:12 -0400 |
| commit | 7b99577ff376d58addf149eebe0ffff46351b3d7 (patch) | |
| tree | fea34e0dd554996b02e7d414af615a0d2508e4a2 /net/sunrpc | |
| parent | c27d205baa8255ad152f26064ecf1fddd0258a5f (diff) | |
| download | linux-stable-7b99577ff376d58addf149eebe0ffff46351b3d7.tar.gz linux-stable-7b99577ff376d58addf149eebe0ffff46351b3d7.tar.bz2 linux-stable-7b99577ff376d58addf149eebe0ffff46351b3d7.zip | |
SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
commit 89a3c9f5b9f0bcaa9aea3e8b2a616fcaea9aad78 upstream.
@subbuf is an output parameter of xdr_buf_subsegment(). A survey of
call sites shows that @subbuf is always uninitialized before
xdr_buf_segment() is invoked by callers.
There are some execution paths through xdr_buf_subsegment() that do
not set all of the fields in @subbuf, leaving some pointer fields
containing garbage addresses. Subsequent processing of that buffer
then results in a page fault.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/sunrpc')
| -rw-r--r-- | net/sunrpc/xdr.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c index 451ca7ec321c..7ef37054071f 100644 --- a/net/sunrpc/xdr.c +++ b/net/sunrpc/xdr.c @@ -1118,6 +1118,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf, base = 0; } else { base -= buf->head[0].iov_len; + subbuf->head[0].iov_base = buf->head[0].iov_base; subbuf->head[0].iov_len = 0; } @@ -1130,6 +1131,8 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf, base = 0; } else { base -= buf->page_len; + subbuf->pages = buf->pages; + subbuf->page_base = 0; subbuf->page_len = 0; } @@ -1141,6 +1144,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf, base = 0; } else { base -= buf->tail[0].iov_len; + subbuf->tail[0].iov_base = buf->tail[0].iov_base; subbuf->tail[0].iov_len = 0; } |