svcrdma: Verify read-list fits within RPCSVC_MAXPAGES
authorTom Tucker <tom@opengridcomputing.com>
Tue, 13 May 2008 14:16:05 +0000 (09:16 -0500)
committerTom Tucker <tom@opengridcomputing.com>
Mon, 19 May 2008 12:34:02 +0000 (07:34 -0500)
A RDMA read-list cannot contain more elements than RPCSVC_MAXPAGES or
it will overflow the DTO context. Verify this when processing the
protocol header.

Signed-off-by: Tom Tucker <tom@opengridcomputing.com>
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c

index 6b16d8cd5682481d92a2357ea3a03c7c4af1f2b3..06ab4841537b236a395377098fb073ca3060a549 100644 (file)
@@ -306,6 +306,8 @@ static int rdma_read_xdr(struct svcxprt_rdma *xprt,
        ch_sge_ary = (struct chunk_sge *)tmp_ch_ctxt->sge;
 
        svc_rdma_rcl_chunk_counts(ch, &ch_count, &byte_count);
+       if (ch_count > RPCSVC_MAXPAGES)
+               return -EINVAL;
        sge_count = rdma_rcl_to_sge(xprt, rqstp, hdr_ctxt, rmsgp,
                                    sge, ch_sge_ary,
                                    ch_count, byte_count);