diff options
| author | Tom Tucker <tom@opengridcomputing.com> | 2008-05-13 16:16:05 +0200 |
|---|---|---|
| committer | Tom Tucker <tom@opengridcomputing.com> | 2008-05-19 14:34:02 +0200 |
| commit | a6f911c04e20b98feb4b33d3aba2976851977d6a (patch) | |
| tree | 54a34d7007ca8d1d39f55396e2d084f6f9310e91 /net | |
| parent | svcrdma: Change svc_rdma_send_error return type to void (diff) | |
| download | linux-a6f911c04e20b98feb4b33d3aba2976851977d6a.tar.xz linux-a6f911c04e20b98feb4b33d3aba2976851977d6a.zip | |
svcrdma: Verify read-list fits within RPCSVC_MAXPAGES
A RDMA read-list cannot contain more elements than RPCSVC_MAXPAGES or
it will overflow the DTO context. Verify this when processing the
protocol header.
Signed-off-by: Tom Tucker <tom@opengridcomputing.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c index 6b16d8cd5682..06ab4841537b 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c +++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c @@ -306,6 +306,8 @@ static int rdma_read_xdr(struct svcxprt_rdma *xprt, ch_sge_ary = (struct chunk_sge *)tmp_ch_ctxt->sge; svc_rdma_rcl_chunk_counts(ch, &ch_count, &byte_count); + if (ch_count > RPCSVC_MAXPAGES) + return -EINVAL; sge_count = rdma_rcl_to_sge(xprt, rqstp, hdr_ctxt, rmsgp, sge, ch_sge_ary, ch_count, byte_count); |