Received: by 2002:a6b:fb09:0:0:0:0:0 with SMTP id h9csp958397iog; Thu, 30 Jun 2022 13:49:49 -0700 (PDT) X-Google-Smtp-Source: AGRyM1sgxIKE0lv7lZpkypJzGEA9yf2TZ9iCaTSlCsp2NYQLQLF2n1CrMqtUfxKA7Dr2M8xV0rhl X-Received: by 2002:a05:6402:11d2:b0:437:a02:5c79 with SMTP id j18-20020a05640211d200b004370a025c79mr13952471edw.400.1656622188898; Thu, 30 Jun 2022 13:49:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1656622188; cv=none; d=google.com; s=arc-20160816; b=NcvnKQDEu+8ONmamTA4rqtItxPl/V6mWbWvIvubiAzE/Sr07Vmrbq8w8Z6IAr03For OvlblTtsPujHD6bNAGpSDBA6KiXs/QSZ5JFHhgY0EVO+fj+5h5i9tVtynCv43b3rkOIf QckFExSAvF/XVCS+bGvusES7rJVTkQzLSjF4KKlUbmy6eFfxU5+8q4ZaCuiBUHdl4TMm Oj6nIolze78e7p/nKr/m0I8lldZQ9arqQNA2NIxXXNUKpEnQeze8FeTeQZXy9bhxSeIf Ml6VjYbLizp6JmNv3OE4b5ItEZ8q+ATVX3SsPUUUr2qPvbjdby4lM9ELzH1MsKoAPoMu kJJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:message-id:date:cc:to:from:subject; bh=NUG3u1jynqU2aGgN1Xa493Xw7Jz9teUgx7Tav7C6n3c=; b=HCOW1Ey9KOFhVvEElDOT9P9xETiGw+PdZ1AT9L121QiXR33xTmVj6RfFiat6naaJvm g+OupDRcYbE+v3Xj97qtYzY3ZMbMUkpDmxO76ffWq25X7qvUlA1Seh63Z4pOyM1TszUc UKgJIdbyc+vKwxd3P0pfaF4GL1uNFySqQMfjsWSCVbcARcdKqSiEogbQ9fMFYi/3zxwd q5ZPwznKzwvO0T+muqgBE2NPd2EIJXnc+nVvhCfaBztleSLnhQNfFccOiytfJ19ENWx8 KB3GAQcI+L4hPQBWU1lKAThxJqlGP71zfmQ5WENTfNyFf8ktodts2zEHmpM5JsuyM7v+ Vz/g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-nfs-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=oracle.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id sg10-20020a170907a40a00b0072a4b4fb1e0si6563158ejc.911.2022.06.30.13.49.12; Thu, 30 Jun 2022 13:49:48 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-nfs-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=oracle.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230148AbiF3UsW (ORCPT + 99 others); Thu, 30 Jun 2022 16:48:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43044 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229838AbiF3UsV (ORCPT ); Thu, 30 Jun 2022 16:48:21 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C90961835C for ; Thu, 30 Jun 2022 13:48:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6E30462358 for ; Thu, 30 Jun 2022 20:48:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83134C34115; Thu, 30 Jun 2022 20:48:19 +0000 (UTC) Subject: [PATCH v2] SUNRPC: Fix READ_PLUS crasher From: Chuck Lever To: linux-nfs@vger.kernel.org Cc: anna.schumaker@netapp.com, bfields@fieldses.org, zlang@redhat.com Date: Thu, 30 Jun 2022 16:48:18 -0400 Message-ID: <165662209842.1459.4593520026847863736.stgit@klimt.1015granger.net> User-Agent: StGit/1.5.dev3+g9561319 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-6.7 required=5.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_HI,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org Looks like there are still cases when "space_left - frag1bytes" can legitimately exceed PAGE_SIZE. Ensure that xdr->end always remains within the current encode buffer. Reported-by: Bruce Fields Reported-by: Zorro Lang Link: https://bugzilla.kernel.org/show_bug.cgi?id=216151 Fixes: 6c254bf3b637 ("SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()") Signed-off-by: Chuck Lever --- net/sunrpc/xdr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c index f87a2d8f23a7..5d2b3e6979fb 100644 --- a/net/sunrpc/xdr.c +++ b/net/sunrpc/xdr.c @@ -984,7 +984,7 @@ static noinline __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr, p = page_address(*xdr->page_ptr); xdr->p = p + frag2bytes; space_left = xdr->buf->buflen - xdr->buf->len; - if (space_left - nbytes >= PAGE_SIZE) + if (space_left - frag1bytes >= PAGE_SIZE) xdr->end = p + PAGE_SIZE; else xdr->end = p + space_left - frag1bytes;