diff options
| author |   Chuck Lever <chuck.lever@oracle.com> | 2019-06-19 10:32:43 -0400 |
|---|---|---|
| committer |   Anna Schumaker <Anna.Schumaker@Netapp.com> | 2019-07-09 10:30:11 -0400 |
| commit | 1310051c720a83c5717658bcbff710b260f2bff9 (patch) | |
| tree | 4a1c7eff7b5bb8ed39f1bdd3c8441664eeb62a64 /net/sunrpc/xprtrdma/transport.c | |
| parent | xprtrdma: Fix use-after-free in rpcrdma_post_recvs (diff) | |
| download | linux-dev-1310051c720a83c5717658bcbff710b260f2bff9.tar.xz linux-dev-1310051c720a83c5717658bcbff710b260f2bff9.zip | |
xprtrdma: Replace use of xdr_stream_pos in rpcrdma_marshal_req
This is a latent bug. xdr_stream_pos works by subtracting
xdr_stream::nwords from xdr_buf::len. But xdr_stream::nwords is not
initialized by xdr_init_encode().
It works today only because all fields in rpcrdma_req::rl_stream
are initialized to zero by rpcrdma_req_create, making the
subtraction in xdr_stream_pos always a no-op.
I found this issue via code inspection. It was introduced by commit
39f4cd9e9982 ("xprtrdma: Harden chunk list encoding against send
buffer overflow"), but the code has changed enough since then that
this fix can't be automatically applied to stable.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Diffstat (limited to 'net/sunrpc/xprtrdma/transport.c')
0 files changed, 0 insertions, 0 deletions