Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 80414abc authored by Chuck Lever's avatar Chuck Lever Committed by Anna Schumaker
Browse files

xprtrdma: rpcrdma_inline_fixup() overruns the receive page list 



When the remaining length of an incoming reply is longer than the
XDR buf's page_len, switch over to the tail iovec instead of
copying more than page_len bytes into the page list.

Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Tested-by: default avatarSteve Wise <swise@opengridcomputing.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent 5ab81428

net/sunrpc/xprtrdma/rpc_rdma.c

+11 −5
Original line number Diff line number Diff line
@@ -773,12 +773,17 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad) 
	page_base &= ~PAGE_MASK;



	if (copy_len && rqst->rq_rcv_buf.page_len) {

		npages = PAGE_ALIGN(page_base +

			rqst->rq_rcv_buf.page_len) >> PAGE_SHIFT;

		int pagelist_len;



		pagelist_len = rqst->rq_rcv_buf.page_len;

		if (pagelist_len > copy_len)

			pagelist_len = copy_len;

		npages = PAGE_ALIGN(page_base + pagelist_len) >> PAGE_SHIFT;

		for (; i < npages; i++) {

			curlen = PAGE_SIZE - page_base;

			if (curlen > copy_len)

				curlen = copy_len;

			if (curlen > pagelist_len)

				curlen = pagelist_len;



			dprintk("RPC:       %s: page %d"

				" srcp 0x%p len %d curlen %d\n",

				__func__, i, srcp, copy_len, curlen);
@@ -788,7 +793,8 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad) 
			kunmap_atomic(destp);

			srcp += curlen;

			copy_len -= curlen;

			if (copy_len == 0)

			pagelist_len -= curlen;

			if (!pagelist_len)

				break;

			page_base = 0;

		}