This is a note to let you know that I've just added the patch titled
SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
sunrpc-properly-set-the-subbuf-parameter-of-xdr_buf_subsegment.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 89a3c9f5b9f0bcaa9aea3e8b2a616fcaea9aad78 Mon Sep 17 00:00:00 2001
From: Chuck Lever <chuck.lever@xxxxxxxxxx>
Date: Thu, 25 Jun 2020 11:32:34 -0400
Subject: SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
From: Chuck Lever <chuck.lever@xxxxxxxxxx>
commit 89a3c9f5b9f0bcaa9aea3e8b2a616fcaea9aad78 upstream.
@subbuf is an output parameter of xdr_buf_subsegment(). A survey of
call sites shows that @subbuf is always uninitialized before
xdr_buf_segment() is invoked by callers.
There are some execution paths through xdr_buf_subsegment() that do
not set all of the fields in @subbuf, leaving some pointer fields
containing garbage addresses. Subsequent processing of that buffer
then results in a page fault.
Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Anna Schumaker <Anna.Schumaker@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/sunrpc/xdr.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -1031,6 +1031,7 @@ xdr_buf_subsegment(struct xdr_buf *buf,
base = 0;
} else {
base -= buf->head[0].iov_len;
+ subbuf->head[0].iov_base = buf->head[0].iov_base;
subbuf->head[0].iov_len = 0;
}
@@ -1043,6 +1044,8 @@ xdr_buf_subsegment(struct xdr_buf *buf,
base = 0;
} else {
base -= buf->page_len;
+ subbuf->pages = buf->pages;
+ subbuf->page_base = 0;
subbuf->page_len = 0;
}
@@ -1054,6 +1057,7 @@ xdr_buf_subsegment(struct xdr_buf *buf,
base = 0;
} else {
base -= buf->tail[0].iov_len;
+ subbuf->tail[0].iov_base = buf->tail[0].iov_base;
subbuf->tail[0].iov_len = 0;
}
Patches currently in stable-queue which might be from chuck.lever@xxxxxxxxxx are
queue-4.4/sunrpc-properly-set-the-subbuf-parameter-of-xdr_buf_subsegment.patch
