Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca5c76ab authored by Chuck Lever's avatar Chuck Lever Committed by J. Bruce Fields
Browse files

svcrdma: Improve Reply chunk sanity checking 



Identify malformed transport headers and unsupported chunk
combinations as early as possible.

- Ensure that segment lengths are not crazy.

- Ensure that the Reply chunk's segment count is not crazy.

With a 1KB inline threshold, the largest number of Write segments
that can be conveyed is about 60 (for a RDMA_NOMSG Reply message).

Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 3c22f326

net/sunrpc/xprtrdma/svc_rdma_recvfrom.c

+11 −6
Original line number Diff line number Diff line
@@ -217,15 +217,20 @@ static __be32 *xdr_check_write_list(__be32 *p, const __be32 *end) 
	return p;

}



static __be32 *xdr_check_reply_chunk(__be32 *p, __be32 *end)

/* Sanity check the Reply chunk.

 *

 * Sanity checks:

 * - Reply chunk does not overflow buffer.

 * - Segment size limited by largest NFS data payload.

 *

 * Returns pointer to the following RPC header.

 */

static __be32 *xdr_check_reply_chunk(__be32 *p, const __be32 *end)

{

	__be32 *next;



	if (*p++ != xdr_zero) {

		next = p + 1 + be32_to_cpup(p) * rpcrdma_segment_maxsz;

		if (next > end)

		p = xdr_check_write_chunk(p, end, MAX_BYTES_SPECIAL_SEG);

		if (!p)

			return NULL;

		p = next;

	}

	return p;

}