Re: [PATCH] sunrpc: do array overrun check in svc_recv before allocating pages

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, May 04, 2012 at 11:44:12AM -0400, Jeff Layton wrote:
> There's little point in waiting until after we allocate all of the pages
> to see if we're going to overrun the array. In the event that this
> calculation is really off we could end up scribbling over a bunch of
> memory and make it tougher to debug.

OK, thanks.--b.

> 
> Signed-off-by: Jeff Layton <jlayton@xxxxxxxxxx>
> ---
>  net/sunrpc/svc_xprt.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
> index 4bda09d..8195c6a 100644
> --- a/net/sunrpc/svc_xprt.c
> +++ b/net/sunrpc/svc_xprt.c
> @@ -601,6 +601,7 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
>  
>  	/* now allocate needed pages.  If we get a failure, sleep briefly */
>  	pages = (serv->sv_max_mesg + PAGE_SIZE) / PAGE_SIZE;
> +	BUG_ON(pages >= RPCSVC_MAXPAGES);
>  	for (i = 0; i < pages ; i++)
>  		while (rqstp->rq_pages[i] == NULL) {
>  			struct page *p = alloc_page(GFP_KERNEL);
> @@ -615,7 +616,6 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
>  			rqstp->rq_pages[i] = p;
>  		}
>  	rqstp->rq_pages[i++] = NULL; /* this might be seen in nfs_read_actor */
> -	BUG_ON(pages >= RPCSVC_MAXPAGES);
>  
>  	/* Make arg->head point to first page and arg->pages point to rest */
>  	arg = &rqstp->rq_arg;
> -- 
> 1.7.7.6
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Filesystem Development]     [Linux USB Development]     [Linux Media Development]     [Video for Linux]     [Linux NILFS]     [Linux Audio Users]     [Yosemite Info]     [Linux SCSI]

  Powered by Linux