[Disco,SRU,1/1] SUNRPC: Fix another issue with MIC buffer space
diff mbox series

Message ID 20200113085302.23180-2-po-hsu.lin@canonical.com
State New
Headers show
Series
  • [Disco,SRU,1/1] SUNRPC: Fix another issue with MIC buffer space
Related show

Commit Message

Po-Hsu Lin Jan. 13, 2020, 8:53 a.m. UTC
From: Chuck Lever <chuck.lever@oracle.com>

BugLink: https://bugs.launchpad.net/bugs/1858832

xdr_shrink_pagelen() BUG's when @len is larger than buf->page_len.
This can happen when xdr_buf_read_mic() is given an xdr_buf with
a small page array (like, only a few bytes).

Instead, just cap the number of bytes that xdr_shrink_pagelen()
will move.

Fixes: 5f1bc39979d ("SUNRPC: Fix buffer handling of GSS MIC ... ")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
(backported from commit e8d70b321ecc9b23d09b8df63e38a2f73160c209)
[PHLin: fuzzy adjustment]
Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
---
 net/sunrpc/xdr.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

Comments

Stefan Bader Jan. 16, 2020, 2:31 p.m. UTC | #1
On 13.01.20 09:53, Po-Hsu Lin wrote:
> From: Chuck Lever <chuck.lever@oracle.com>
> 
> BugLink: https://bugs.launchpad.net/bugs/1858832
> 
> xdr_shrink_pagelen() BUG's when @len is larger than buf->page_len.
> This can happen when xdr_buf_read_mic() is given an xdr_buf with
> a small page array (like, only a few bytes).
> 
> Instead, just cap the number of bytes that xdr_shrink_pagelen()
> will move.
> 
> Fixes: 5f1bc39979d ("SUNRPC: Fix buffer handling of GSS MIC ... ")
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
> (backported from commit e8d70b321ecc9b23d09b8df63e38a2f73160c209)
> [PHLin: fuzzy adjustment]
> Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
> ---

This affects derivatives, so still need it.

>  net/sunrpc/xdr.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
> index 6ca833d..b8047f4 100644
> --- a/net/sunrpc/xdr.c
> +++ b/net/sunrpc/xdr.c
> @@ -414,13 +414,12 @@ xdr_shrink_bufhead(struct xdr_buf *buf, size_t len)
>  }
>  
>  /**
> - * xdr_shrink_pagelen
> + * xdr_shrink_pagelen - shrinks buf->pages by up to @len bytes
>   * @buf: xdr_buf
>   * @len: bytes to remove from buf->pages
>   *
> - * Shrinks XDR buffer's page array buf->pages by
> - * 'len' bytes. The extra data is not lost, but is instead
> - * moved into the tail.
> + * The extra data is not lost, but is instead moved into buf->tail.
> + * Returns the actual number of bytes moved.
>   */
>  static void
>  xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)
> @@ -431,8 +430,8 @@ xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)
>  	unsigned int tailbuf_len;
>  
>  	tail = buf->tail;
> -	BUG_ON (len > pglen);
> -
> +	if (len > buf->page_len)
> +		len = buf-> page_len;
>  	tailbuf_len = buf->buflen - buf->head->iov_len - buf->page_len;
>  
>  	/* Shift the tail first */
>

Patch
diff mbox series

diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 6ca833d..b8047f4 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -414,13 +414,12 @@  xdr_shrink_bufhead(struct xdr_buf *buf, size_t len)
 }
 
 /**
- * xdr_shrink_pagelen
+ * xdr_shrink_pagelen - shrinks buf->pages by up to @len bytes
  * @buf: xdr_buf
  * @len: bytes to remove from buf->pages
  *
- * Shrinks XDR buffer's page array buf->pages by
- * 'len' bytes. The extra data is not lost, but is instead
- * moved into the tail.
+ * The extra data is not lost, but is instead moved into buf->tail.
+ * Returns the actual number of bytes moved.
  */
 static void
 xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)
@@ -431,8 +430,8 @@  xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)
 	unsigned int tailbuf_len;
 
 	tail = buf->tail;
-	BUG_ON (len > pglen);
-
+	if (len > buf->page_len)
+		len = buf-> page_len;
 	tailbuf_len = buf->buflen - buf->head->iov_len - buf->page_len;
 
 	/* Shift the tail first */