Joshua Rogers 5f140b5251 svcrdma: bound check rq_pages index in inline path ...

[ Upstream commit d1bea0ce35 ]

svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without
verifying rc_curpage stays within the allocated page array. Add guards
before the first use and after advancing to a new page.

Fixes: d7cc739726 ("svcrdma: support multiple Read chunks per RPC")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
[ replaced rqstp->rq_maxpages with ARRAY_SIZE(rqstp->rq_pages) ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-08 10:14:58 +01:00

..

auth_gss

SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf

2026-01-08 10:14:25 +01:00

xprtrdma

svcrdma: bound check rq_pages index in inline path

2026-01-08 10:14:58 +01:00

.kunitconfig

…

addr.c

…

auth_null.c

…

auth_tls.c

…

auth_unix.c

…

auth.c

…

backchannel_rqst.c

…

cache.c

…

clnt.c

…

debugfs.c

…

fail.h

…

Kconfig

…

Makefile

…

netns.h

…

rpc_pipe.c

…

rpcb_clnt.c

…

sched.c

…

socklib.c

…

socklib.h

…

stats.c

…

sunrpc_syms.c

…

sunrpc.h

…

svc_xprt.c

nfsd: unregister with rpcbind when deleting a transport

2025-10-19 16:34:03 +02:00

svc.c

…

svcauth_unix.c

…

svcauth.c

…

svcsock.c

nfsd: unregister with rpcbind when deleting a transport

2025-10-19 16:34:03 +02:00

sysctl.c

…

sysfs.c

…

sysfs.h

…

timer.c

…

xdr.c

…

xprt.c

…

xprtmultipath.c

…

xprtsock.c

…