2008-04-14 16:27:42

by Chuck Lever III

[permalink] [raw]
Subject: [PATCH 05/24] SUNRPC: Address potential buffer length overflow in svc_tcp_sendto

Paranoia: Ensure a negative error value returned from svc_sendto()
doesn't match a large buffer length.

Signed-off-by: Chuck Lever <[email protected]>
---

net/sunrpc/svcsock.c | 24 ++++++++++++------------
1 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index a8ae279..d077071 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -956,18 +956,18 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
return -ENOTCONN;

sent = svc_sendto(rqstp, &rqstp->rq_res);
- if (sent != xbufp->len) {
- printk(KERN_NOTICE
- "rpc-srv/tcp: %s: %s %d when sending %d bytes "
- "- shutting down socket\n",
- rqstp->rq_xprt->xpt_server->sv_name,
- (sent<0)?"got error":"sent only",
- sent, xbufp->len);
- set_bit(XPT_CLOSE, &rqstp->rq_xprt->xpt_flags);
- svc_xprt_enqueue(rqstp->rq_xprt);
- sent = -EAGAIN;
- }
- return sent;
+ if (sent > 0 && sent == xbufp->len)
+ return sent;
+
+ printk(KERN_NOTICE "%s: %s %d when sending %u bytes "
+ "- shutting down TCP socket\n",
+ rqstp->rq_xprt->xpt_server->sv_name,
+ (sent < 0) ? "got error" : "sent only",
+ sent, xbufp->len);
+
+ set_bit(XPT_CLOSE, &rqstp->rq_xprt->xpt_flags);
+ svc_xprt_enqueue(rqstp->rq_xprt);
+ return -EAGAIN;
}

/*