SUNRPC: Trap RDMA segment overflows

Prevent svc_rdma_build_writes() from walking off the end of a Write
chunk's segment array. Caught with KASAN.

The test that this fix replaces is invalid, and might have been left
over from an earlier prototype of the PCL work.

Fixes: 7a1cbfa18059 ("svcrdma: Use parsed chunk lists to construct RDMA Writes")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
index 5f0155fdefc7b10b3a21802876b9890fd6e99e7a..11cf7c6466443e7fcadf7084d4cc138dd820b7dd 100644 (file)
--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
@@ -478,10 +478,10 @@ svc_rdma_build_writes(struct svc_rdma_write_info *info,
                unsigned int write_len;
                u64 offset;
 
-               seg = &info->wi_chunk->ch_segments[info->wi_seg_no];
-               if (!seg)
+               if (info->wi_seg_no >= info->wi_chunk->ch_segcount)
                        goto out_overflow;
 
+               seg = &info->wi_chunk->ch_segments[info->wi_seg_no];
                write_len = min(remaining, seg->rs_length - info->wi_seg_off);
                if (!write_len)
                        goto out_overflow;