SUNRPC: Fix another issue with MIC buffer space
[ Upstream commite8d70b321e
] xdr_shrink_pagelen() BUG's when @len is larger than buf->page_len. This can happen when xdr_buf_read_mic() is given an xdr_buf with a small page array (like, only a few bytes). Instead, just cap the number of bytes that xdr_shrink_pagelen() will move. Fixes:5f1bc39979
("SUNRPC: Fix buffer handling of GSS MIC ... ") Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Reviewed-by: Benjamin Coddington <bcodding@redhat.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
16128944c9
commit
e0e2379bfc
|
@ -436,13 +436,12 @@ xdr_shrink_bufhead(struct xdr_buf *buf, size_t len)
|
|||
}
|
||||
|
||||
/**
|
||||
* xdr_shrink_pagelen
|
||||
* xdr_shrink_pagelen - shrinks buf->pages by up to @len bytes
|
||||
* @buf: xdr_buf
|
||||
* @len: bytes to remove from buf->pages
|
||||
*
|
||||
* Shrinks XDR buffer's page array buf->pages by
|
||||
* 'len' bytes. The extra data is not lost, but is instead
|
||||
* moved into the tail.
|
||||
* The extra data is not lost, but is instead moved into buf->tail.
|
||||
* Returns the actual number of bytes moved.
|
||||
*/
|
||||
static unsigned int
|
||||
xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)
|
||||
|
@ -455,8 +454,8 @@ xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)
|
|||
|
||||
result = 0;
|
||||
tail = buf->tail;
|
||||
BUG_ON (len > pglen);
|
||||
|
||||
if (len > buf->page_len)
|
||||
len = buf-> page_len;
|
||||
tailbuf_len = buf->buflen - buf->head->iov_len - buf->page_len;
|
||||
|
||||
/* Shift the tail first */
|
||||
|
|
Loading…
Reference in New Issue