svcrdma: Verify read-list fits within RPCSVC_MAXPAGES



A RDMA read-list cannot contain more elements than RPCSVC_MAXPAGES or
it will overflow the DTO context. Verify this when processing the
protocol header.

Signed-off-by: Tom Tucker <tom@opengridcomputing.com>

parent 008fdbc5

net/sunrpc/xprtrdma/svc_rdma_recvfrom.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -306,6 +306,8 @@ static int rdma_read_xdr(struct svcxprt_rdma *xprt,
		ch_sge_ary = (struct chunk_sge *)tmp_ch_ctxt->sge;

		svc_rdma_rcl_chunk_counts(ch, &ch_count, &byte_count);
		if (ch_count > RPCSVC_MAXPAGES)
		return -EINVAL;
		sge_count = rdma_rcl_to_sge(xprt, rqstp, hdr_ctxt, rmsgp,
		sge, ch_sge_ary,
		ch_count, byte_count);