Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Zorro Lang <zlang@redhat.com>
CC:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        Anna Schumaker <anna.schumaker@netapp.com>,
        Bruce Fields <bfields@fieldses.org>
Subject: Re: [PATCH v2] SUNRPC: Fix READ_PLUS crasher
Thread-Topic: [PATCH v2] SUNRPC: Fix READ_PLUS crasher
Thread-Index: AQHYjMLF3XxMjMXp40+0TpjOlgRuaa1tzJaAgACc24A=
Date:   Mon, 4 Jul 2022 16:16:58 +0000
Message-ID: <0E657811-774F-474F-BA33-869F421A0874@oracle.com>
References: <165662209842.1459.4593520026847863736.stgit@klimt.1015granger.net>
 <20220704065533.pfpvpn7ihxs7vagf@zlang-mailbox>
In-Reply-To: <20220704065533.pfpvpn7ihxs7vagf@zlang-mailbox>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?p9fZzHbBgYiq0bGCTnQX5KRCdi3BlujdQex8NPVxYqV7DR8LBFBfJmmRf1he?=
 =?us-ascii?Q?GA9ySRgRaHvT1+RsEi05AjOW9hIua2bB6P/kHlnXAkjjIbezpRYiE2CE4iGV?=
 =?us-ascii?Q?flJ0EAYccSOlsXJ+nQVb7246UDCDVImN6Dy0I0NqUISNxwIJNWFcJbSpWN2Y?=
 =?us-ascii?Q?Kq4pxfTc3xLtxrfr4zyaWmYb5tDnXzDoIYpn7XuCXprpV3uJaaWK9Uox8FT6?=
 =?us-ascii?Q?2h/nNAM3YBxA1Z0/DoHyFQyg+wlhbWFukLXSV551F3VfFr/9FJ+SxFJ495CM?=
 =?us-ascii?Q?aWcpMiCSl2FE8oqYcOZ39AFx8KUybQfYv+Ghhqt9pV3K/+GrVqj0a+fna/sf?=
 =?us-ascii?Q?Q7fh+mCTDHRpBizxcwTQ1Xn7Jc/Hht37EQuGim9Ee4KrmyHvU4wKdiG8AFnY?=
 =?us-ascii?Q?kR2cttDylf811G/EUxcH0JsIl/nqfKQvbCVQ3QBXLdYAqO7Iu2t4Brp25kDT?=
 =?us-ascii?Q?r2ZI0Hsn/hzdGptvFa3mQe7q64Tz89vR8q6BOn2u/qsVe+8NmJB6K6S3zApt?=
 =?us-ascii?Q?2CfPJwZ06uMgd9ccjWotlSHe2SrEv6luHHSHTH42VNFD73rRadN8yjHkQYAd?=
 =?us-ascii?Q?WqIKmtkn4cpfbmLD2znZJCKSAmunFg2UgQHZBkpQxnPBu4N38dx00b0bMGxk?=
 =?us-ascii?Q?08PnzquHlS1yW8sLN3dhGNG1otvYLJ7MtiYCRHqRP47dMIo7rDEQixTjbROf?=
 =?us-ascii?Q?egJogvg25TkcDAAgOa4/aJXNgqOigZFaVbGzOl3s22WsFhihxkIzwX2Nojyu?=
 =?us-ascii?Q?+BcEbNfFkRDDuHEOC+7U+Ngc1k/gH4AVvfK6VFtWsqxiBK3LEfnen5Vm8hvr?=
 =?us-ascii?Q?p+sjqiv3OhC3ZAfPj9TJTXvidd6xTobphofNBxTv2Xmr8awXZ/gUb5sQoKAW?=
 =?us-ascii?Q?VVaqnCvYgNkONRD+7ERhBKWLJX5OCVmjL8Re7vKwArksmqGR11C1R8du/dRI?=
 =?us-ascii?Q?g/5FqE5pRo3Kyr5lswH4OzbvFr9tqrb2Hrraftd6o5mrwrPySMmBvxrJkoNB?=
 =?us-ascii?Q?4Rqzc2eByMf2IlALLKTW4nmkDNyvL94MqBJ3oa32TBgXFw4JYm37/Xd+83IB?=
 =?us-ascii?Q?Usbqq6PVV3xqod2ZZg0yGi15bA9BkYTK4zEzI1eQSq7A2qa0pjdy6RPYzstS?=
 =?us-ascii?Q?iIa8U+wku2LbPjQBbiQopLQUwk7Ci82WUG9M0D3LSOg3/4Rn/Pvy8dKYjIU4?=
 =?us-ascii?Q?AvU+jlHfygTOL6Vb3aEC3ldG3FXam9AfDB10+fj2HjW1PtNAlnE9Y+2X/s2+?=
 =?us-ascii?Q?kklWUFw7ftagqjeA3QPkDkM4yn9YyYoM33nM23trNyweFEptVvkFhv3Kvcz5?=
 =?us-ascii?Q?J85c4it0yv1dR8YaJxBZQ8T5ERcSzftn+SGiBJJF8xDoaw3wdPSfXPYIeZkL?=
 =?us-ascii?Q?ta2mhxmnAhik+3PXDe2LSUG9ZjEwVGwrG5qFHg/CiqKKHDyaaTooVB0VL4rQ?=
 =?us-ascii?Q?NkzNjjgY2vez+RY2Wui/7Eo1H9Mk+VQiErLBaBgdREZJ6exnd7c3QLabhmUX?=
 =?us-ascii?Q?JchdY6xyWfBO/LWH0AA2BwQ+l1hB82xt2/TWXJXoEhfUwdnIoA+dwN93Ecuz?=
 =?us-ascii?Q?E9/AwJxG9W03ZOi7M7OkKc+BLvBfm1H5NcwFN9gkjsaOnktx+1gbI0HGDVnw?=
 =?us-ascii?Q?pg=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <566F514A4BC4E8439100B967547E6E42@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 49bcb6b5-3b3a-4b0c-3738-08da5dd89ea7
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Jul 2022 16:16:58.2111
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: v0wpTicWyckfmETynyFcEw6i1vbfqACHyNByj+uB7K0HBf0GbacXKpdsJJ0q+p8KpZwJMSG8dgF21/lt2t+Llw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR10MB3459
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.883
 definitions=2022-07-04_16:2022-06-28,2022-07-04 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxlogscore=999
 spamscore=0 malwarescore=0 phishscore=0 bulkscore=0 mlxscore=0
 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2204290000 definitions=main-2207040070
X-Proofpoint-GUID: BBFr39s1ndWjuW-hQfsjm_xgRjkMTYh5
X-Proofpoint-ORIG-GUID: BBFr39s1ndWjuW-hQfsjm_xgRjkMTYh5
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Jul 4, 2022, at 2:55 AM, Zorro Lang <zlang@redhat.com> wrote:
>=20
> On Thu, Jun 30, 2022 at 04:48:18PM -0400, Chuck Lever wrote:
>> Looks like there are still cases when "space_left - frag1bytes" can
>> legitimately exceed PAGE_SIZE. Ensure that xdr->end always remains
>> within the current encode buffer.
>>=20
>> Reported-by: Bruce Fields <bfields@fieldses.org>
>> Reported-by: Zorro Lang <zlang@redhat.com>
>> Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D216151
>> Fixes: 6c254bf3b637 ("SUNRPC: Fix the calculation of xdr->end in xdr_get=
_next_encode_buffer()")
>> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
>> ---
>=20
> I can't reproduce this bug by merging this patch:
>=20
> FSTYP         -- nfs
> PLATFORM      -- Linux/x86_64 ibm-xxxxx-08 5.19.0-rc4+ #1 SMP PREEMPT_DYN=
AMIC Sat Jul 2 09:59:50 EDT 2022
> MKFS_OPTIONS  -- ibm-xxxxx-xx.xxx.xxx.xxx.xxxxxx.com:/mnt/xfstests/scratc=
h/nfs-server
> MOUNT_OPTIONS -- -o vers=3D4.2 -o context=3Dsystem_u:object_r:root_t:s0 i=
bm-x3650m4-08.rhts.eng.pek2.redhat.com:/mnt/xfstests/scratch/nfs-server /mn=
t/xfstests/scratch/nfs-client
>=20
> generic/465        12s
> Ran: generic/465
> Passed all 1 tests

Thanks for testing!


>> net/sunrpc/xdr.c |    2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>=20
>> diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
>> index f87a2d8f23a7..5d2b3e6979fb 100644
>> --- a/net/sunrpc/xdr.c
>> +++ b/net/sunrpc/xdr.c
>> @@ -984,7 +984,7 @@ static noinline __be32 *xdr_get_next_encode_buffer(s=
truct xdr_stream *xdr,
>> 	p =3D page_address(*xdr->page_ptr);
>> 	xdr->p =3D p + frag2bytes;
>> 	space_left =3D xdr->buf->buflen - xdr->buf->len;
>> -	if (space_left - nbytes >=3D PAGE_SIZE)
>> +	if (space_left - frag1bytes >=3D PAGE_SIZE)
>> 		xdr->end =3D p + PAGE_SIZE;
>> 	else
>> 		xdr->end =3D p + space_left - frag1bytes;
>>=20
>>=20
>=20

--
Chuck Lever