| Message ID | 20200113085302.23180-2-po-hsu.lin@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | [Disco,SRU,1/1] SUNRPC: Fix another issue with MIC buffer space | expand |
On 13.01.20 09:53, Po-Hsu Lin wrote: > From: Chuck Lever <chuck.lever@oracle.com> > > BugLink: https://bugs.launchpad.net/bugs/1858832 > > xdr_shrink_pagelen() BUG's when @len is larger than buf->page_len. > This can happen when xdr_buf_read_mic() is given an xdr_buf with > a small page array (like, only a few bytes). > > Instead, just cap the number of bytes that xdr_shrink_pagelen() > will move. > > Fixes: 5f1bc39979d ("SUNRPC: Fix buffer handling of GSS MIC ... ") > Signed-off-by: Chuck Lever <chuck.lever@oracle.com> > Reviewed-by: Benjamin Coddington <bcodding@redhat.com> > Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> > (backported from commit e8d70b321ecc9b23d09b8df63e38a2f73160c209) > [PHLin: fuzzy adjustment] > Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com> Acked-by: Stefan Bader <stefan.bader@canonical.com> > --- This affects derivatives, so still need it. > net/sunrpc/xdr.c | 11 +++++------ > 1 file changed, 5 insertions(+), 6 deletions(-) > > diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c > index 6ca833d..b8047f4 100644 > --- a/net/sunrpc/xdr.c > +++ b/net/sunrpc/xdr.c > @@ -414,13 +414,12 @@ xdr_shrink_bufhead(struct xdr_buf *buf, size_t len) > } > > /** > - * xdr_shrink_pagelen > + * xdr_shrink_pagelen - shrinks buf->pages by up to @len bytes > * @buf: xdr_buf > * @len: bytes to remove from buf->pages > * > - * Shrinks XDR buffer's page array buf->pages by > - * 'len' bytes. The extra data is not lost, but is instead > - * moved into the tail. > + * The extra data is not lost, but is instead moved into buf->tail. > + * Returns the actual number of bytes moved. > */ > static void > xdr_shrink_pagelen(struct xdr_buf *buf, size_t len) > @@ -431,8 +430,8 @@ xdr_shrink_pagelen(struct xdr_buf *buf, size_t len) > unsigned int tailbuf_len; > > tail = buf->tail; > - BUG_ON (len > pglen); > - > + if (len > buf->page_len) > + len = buf-> page_len; > tailbuf_len = buf->buflen - buf->head->iov_len - buf->page_len; > > /* Shift the tail first */ >
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c index 6ca833d..b8047f4 100644 --- a/net/sunrpc/xdr.c +++ b/net/sunrpc/xdr.c @@ -414,13 +414,12 @@ xdr_shrink_bufhead(struct xdr_buf *buf, size_t len) } /** - * xdr_shrink_pagelen + * xdr_shrink_pagelen - shrinks buf->pages by up to @len bytes * @buf: xdr_buf * @len: bytes to remove from buf->pages * - * Shrinks XDR buffer's page array buf->pages by - * 'len' bytes. The extra data is not lost, but is instead - * moved into the tail. + * The extra data is not lost, but is instead moved into buf->tail. + * Returns the actual number of bytes moved. */ static void xdr_shrink_pagelen(struct xdr_buf *buf, size_t len) @@ -431,8 +430,8 @@ xdr_shrink_pagelen(struct xdr_buf *buf, size_t len) unsigned int tailbuf_len; tail = buf->tail; - BUG_ON (len > pglen); - + if (len > buf->page_len) + len = buf-> page_len; tailbuf_len = buf->buflen - buf->head->iov_len - buf->page_len; /* Shift the tail first */