From: Olga Kornievskaia <kolga@xxxxxxxxxx>
xfstest generic/013 over on a NFSoRDMA over SoftRoCE or iWarp panics
and running with KASAN reports:
[ 216.018711] BUG: KASAN: wild-memory-access in rpcrdma_complete_rqst+0x447/0x6e0 [rpcrdma]
[ 216.024195] Write of size 12 at addr 0005088000000000 by task kworker/1:1H/480
[ 216.028820]
[ 216.029776] CPU: 1 PID: 480 Comm: kworker/1:1H Not tainted 5.8.0-rc5+ #37
[ 216.034247] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020
[ 216.040604] Workqueue: ib-comp-wq ib_cq_poll_work [ib_core]
[ 216.043739] Call Trace:
[ 216.045014] dump_stack+0x7c/0xb0
[ 216.046757] ? rpcrdma_complete_rqst+0x447/0x6e0 [rpcrdma]
[ 216.050008] ? rpcrdma_complete_rqst+0x447/0x6e0 [rpcrdma]
[ 216.053091] kasan_report.cold.10+0x6a/0x85
[ 216.055703] ? rpcrdma_complete_rqst+0x447/0x6e0 [rpcrdma]
[ 216.058979] check_memory_region+0x183/0x1e0
[ 216.061933] memcpy+0x38/0x60
[ 216.064077] rpcrdma_complete_rqst+0x447/0x6e0 [rpcrdma]
[ 216.067502] ? rpcrdma_reset_cwnd+0x70/0x70 [rpcrdma]
[ 216.070268] ? recalibrate_cpu_khz+0x10/0x10
[ 216.072585] ? rpcrdma_reply_handler+0x604/0x6e0 [rpcrdma]
[ 216.075469] __ib_process_cq+0xa7/0x220 [ib_core]
[ 216.078077] ib_cq_poll_work+0x31/0xb0 [ib_core]
[ 216.080451] process_one_work+0x387/0x6c0
[ 216.082498] worker_thread+0x57/0x5a0
[ 216.084425] ? process_one_work+0x6c0/0x6c0
[ 216.086583] kthread+0x1ca/0x200
[ 216.088775] ? kthread_create_on_node+0xc0/0xc0
[ 216.091847] ret_from_fork+0x22/0x30
Fixes: 6c2190b3fcbc ("NFS: Fix listxattr receive buffer size")
Signed-off-by: Olga Kornievskaia <kolga@xxxxxxxxxx>
---
fs/nfs/nfs42xdr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c
index 6e060a8..e88bc7a 100644
--- a/fs/nfs/nfs42xdr.c
+++ b/fs/nfs/nfs42xdr.c
@@ -196,7 +196,8 @@
1 + nfs4_xattr_name_maxsz + 1)
#define decode_setxattr_maxsz (op_decode_hdr_maxsz + decode_change_info_maxsz)
#define encode_listxattrs_maxsz (op_encode_hdr_maxsz + 2 + 1)
-#define decode_listxattrs_maxsz (op_decode_hdr_maxsz + 2 + 1 + 1 + 1)
+#define decode_listxattrs_maxsz (op_decode_hdr_maxsz + 2 + 1 + 1 + \
+ XDR_QUADLEN(NFS4_OPAQUE_LIMIT))
#define encode_removexattr_maxsz (op_encode_hdr_maxsz + 1 + \
nfs4_xattr_name_maxsz)
#define decode_removexattr_maxsz (op_decode_hdr_maxsz + \
--
1.8.3.1
