Commit cedaf73c authored by Chuck Lever's avatar Chuck Lever Committed by Greg Kroah-Hartman
Browse files

SUNRPC: Fix svcxdr_init_encode's buflen calculation



[ Upstream commit 1242a87d ]

Commit 2825a7f9 ("nfsd4: allow encoding across page boundaries")
added an explicit computation of the remaining length in the rq_res
XDR buffer.

The computation appears to suffer from an "off-by-one" bug. Because
buflen is too large by one page, XDR encoding can run off the end of
the send buffer by eventually trying to use the struct page address
in rq_page_end, which always contains NULL.

Fixes: bddfdbcd ("NFSD: Extract the svcxdr_init_encode() helper")
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 6b55707f
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment