Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
SUNRPC: Tighten bounds checking in svc_rqst_replace_page
svc_rqst_replace_page() builds the Reply buffer by advancing
rq_next_page through the response page range. The bounds
check validates rq_next_page against the full rq_pages array,
but the valid range for rq_next_page is
[rq_respages, rq_page_end].
Use those bounds instead.
This is correct today because rq_respages and rq_page_end
both point into rq_pages, and it prepares for a subsequent
change that separates the Reply page array from rq_pages.
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+4
-4
+4
-4
net/sunrpc/svc.c
+4
-4
net/sunrpc/svc.c
···
934
934
EXPORT_SYMBOL_GPL(svc_set_num_threads);
935
935
936
936
/**
937
-
* svc_rqst_replace_page - Replace one page in rq_pages[]
937
+
* svc_rqst_replace_page - Replace one page in rq_respages[]
938
938
* @rqstp: svc_rqst with pages to replace
939
939
* @page: replacement page
940
940
*
941
-
* When replacing a page in rq_pages, batch the release of the
941
+
* When replacing a page in rq_respages, batch the release of the
942
942
* replaced pages to avoid hammering the page allocator.
943
943
*
944
944
* Return values:
···
947
947
*/
948
948
bool svc_rqst_replace_page(struct svc_rqst *rqstp, struct page *page)
949
949
{
950
-
struct page **begin = rqstp->rq_pages;
951
-
struct page **end = &rqstp->rq_pages[rqstp->rq_maxpages];
950
+
struct page **begin = rqstp->rq_respages;
951
+
struct page **end = rqstp->rq_page_end;
952
952
953
953
if (unlikely(rqstp->rq_next_page < begin || rqstp->rq_next_page > end)) {
954
954
trace_svc_replace_page_err(rqstp);