]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
svcrdma: bound check rq_pages index in inline path
authorJoshua Rogers <linux@joshua.hu>
Fri, 7 Nov 2025 15:09:49 +0000 (10:09 -0500)
committerChuck Lever <chuck.lever@oracle.com>
Mon, 8 Dec 2025 15:51:26 +0000 (10:51 -0500)
commitd1bea0ce35b6095544ee82bb54156fc62c067e58
tree3db485ce306e3926e9856ad06a007ab3a4dbea2b
parent94972027ab55b200e031059fd6c7a649f8248020
svcrdma: bound check rq_pages index in inline path

svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without
verifying rc_curpage stays within the allocated page array. Add guards
before the first use and after advancing to a new page.

Fixes: d7cc73972661 ("svcrdma: support multiple Read chunks per RPC")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
net/sunrpc/xprtrdma/svc_rdma_rw.c