diff options
author | Chuck Lever <chuck.lever@oracle.com> | 2023-03-17 17:09:20 -0400 |
---|---|---|
committer | Chuck Lever <chuck.lever@oracle.com> | 2023-04-26 09:05:01 -0400 |
commit | 0f5162480bd25bd97b91c9153db7afbd89698804 (patch) | |
tree | a273f9e1648e80256d5e4b9321f624d0a9424cd4 /include/linux/sunrpc/svc.h | |
parent | 376bcd9b37632cf191711a68aa25ab42f0048c2e (diff) |
NFSD: Watch for rq_pages bounds checking errors in nfsd_splice_actor()
There have been several bugs over the years where the NFSD splice
actor has attempted to write outside the rq_pages array.
This is a "should never happen" condition, but if for some reason
the pipe splice actor should attempt to walk past the end of
rq_pages, it needs to terminate the READ operation to prevent
corruption of the pointer addresses in the fields just beyond the
array.
A server crash is thus prevented. Since the code is not behaving,
the READ operation returns -EIO to the client. None of the READ
payload data can be trusted if the splice actor isn't operating as
expected.
Suggested-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Diffstat (limited to 'include/linux/sunrpc/svc.h')
-rw-r--r-- | include/linux/sunrpc/svc.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h index 877891536c2f..f5af055280ff 100644 --- a/include/linux/sunrpc/svc.h +++ b/include/linux/sunrpc/svc.h @@ -422,7 +422,7 @@ struct svc_serv *svc_create(struct svc_program *, unsigned int, int (*threadfn)(void *data)); struct svc_rqst *svc_rqst_alloc(struct svc_serv *serv, struct svc_pool *pool, int node); -void svc_rqst_replace_page(struct svc_rqst *rqstp, +bool svc_rqst_replace_page(struct svc_rqst *rqstp, struct page *page); void svc_rqst_free(struct svc_rqst *); void svc_exit_thread(struct svc_rqst *); |