6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Rogers linux@joshua.hu
[ Upstream commit d1bea0ce35b6095544ee82bb54156fc62c067e58 ]
svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array. Add guards before the first use and after advancing to a new page.
Fixes: d7cc73972661 ("svcrdma: support multiple Read chunks per RPC") Cc: stable@vger.kernel.org Signed-off-by: Joshua Rogers linux@joshua.hu Signed-off-by: Chuck Lever chuck.lever@oracle.com [ replaced rqstp->rq_maxpages with ARRAY_SIZE(rqstp->rq_pages) ] Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- net/sunrpc/xprtrdma/svc_rdma_rw.c | 3 +++ 1 file changed, 3 insertions(+)
--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c @@ -841,6 +841,9 @@ static int svc_rdma_copy_inline_range(st for (page_no = 0; page_no < numpages; page_no++) { unsigned int page_len;
+ if (head->rc_curpage >= ARRAY_SIZE(rqstp->rq_pages)) + return -EINVAL; + page_len = min_t(unsigned int, remaining, PAGE_SIZE - head->rc_pageoff);