SUNRPC: Fix another issue with MIC buffer space (e8d70b32) · Commits · 戴 / test

xdr_shrink_pagelen() BUG's when @len is larger than buf->page_len. This can happen when xdr_buf_read_mic() is given an xdr_buf with a small page array (like, only a few bytes). Instead, just cap the number of bytes that xdr_shrink_pagelen() will move. Fixes: ("SUNRPC: Fix buffer handling of GSS MIC ... ") Signed-off-by:

Chuck Lever <chuck.lever@oracle.com> Reviewed-by:

Benjamin Coddington <bcodding@redhat.com> Signed-off-by:

Trond Myklebust <trond.myklebust@hammerspace.com>

net/sunrpc/xdr.c

+5 −6

Original line number	Diff line number	Diff line
		@@ -436,13 +436,12 @@ xdr_shrink_bufhead(struct xdr_buf *buf, size_t len)
		}

		/**
		* xdr_shrink_pagelen
		* xdr_shrink_pagelen - shrinks buf->pages by up to @len bytes
		* @buf: xdr_buf
		* @len: bytes to remove from buf->pages
		*
		* Shrinks XDR buffer's page array buf->pages by
		* 'len' bytes. The extra data is not lost, but is instead
		* moved into the tail.
		* The extra data is not lost, but is instead moved into buf->tail.
		* Returns the actual number of bytes moved.
		*/
		static unsigned int
		xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)
		@@ -455,8 +454,8 @@ xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)

		result = 0;
		tail = buf->tail;
		BUG_ON (len > pglen);

		if (len > buf->page_len)
		len = buf-> page_len;
		tailbuf_len = buf->buflen - buf->head->iov_len - buf->page_len;

		/* Shift the tail first */

Admin message