From: Joshua Rogers Date: Wed, 31 Dec 2025 22:44:24 +0000 (-0500) Subject: svcrdma: bound check rq_pages index in inline path X-Git-Tag: v5.15.198~101 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a22316f5e9a29e4b92030bd8fb9435fe0eb1d5c9;p=thirdparty%2Fkernel%2Fstable.git svcrdma: bound check rq_pages index in inline path [ Upstream commit d1bea0ce35b6095544ee82bb54156fc62c067e58 ] svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array. Add guards before the first use and after advancing to a new page. Fixes: d7cc73972661 ("svcrdma: support multiple Read chunks per RPC") Cc: stable@vger.kernel.org Signed-off-by: Joshua Rogers Signed-off-by: Chuck Lever [ adapted rc_curpage and rq_maxpages fields to ri_pageno and RPCSVC_MAXPAGES constant ] Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c index 270f5c3b8d91f..5791c26cd916b 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c @@ -789,6 +789,9 @@ static int svc_rdma_copy_inline_range(struct svc_rdma_read_info *info, for (page_no = 0; page_no < numpages; page_no++) { unsigned int page_len; + if (info->ri_pageno >= RPCSVC_MAXPAGES) + return -EINVAL; + page_len = min_t(unsigned int, remaining, PAGE_SIZE - info->ri_pageoff);