svcrdma: use rc_pageoff for memcpy byte offset

commit a8ee9099f30654917aa68f55d707b5627e1dbf77 upstream.

svc_rdma_copy_inline_range added rc_curpage (page index) to the page
base instead of the byte offset rc_pageoff. Use rc_pageoff so copies
land within the current page.

Found by ZeroPath (https://zeropath.com)

Fixes: 8e122582680c ("svcrdma: Move svc_rdma_read_info::ri_pageno to struct svc_rdma_recv_ctxt")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
index 5bc950d29366bd3ce72bfe786b2c9158bd0e3971..310de7a80be52a520f8c46be935d4004943a279f 100644 (file)
--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
@@ -851,7 +851,7 @@ static int svc_rdma_copy_inline_range(struct svc_rqst *rqstp,
                        head->rc_page_count++;
 
                dst = page_address(rqstp->rq_pages[head->rc_curpage]);
-               memcpy(dst + head->rc_curpage, src + offset, page_len);
+               memcpy((unsigned char *)dst + head->rc_pageoff, src + offset, page_len);
 
                head->rc_readbytes += page_len;
                head->rc_pageoff += page_len;