diff mbox series

[v1] svcrdma: Catch another Reply chunk overflow case

Message ID 160521813593.2742.8423075329083286889.stgit@klimt.1015granger.net (mailing list archive)
State New
Headers show
Series [v1] svcrdma: Catch another Reply chunk overflow case | expand

Commit Message

Chuck Lever III Nov. 12, 2020, 9:55 p.m. UTC
When space in the Reply chunk runs out in the middle of a segment,
we end up passing a zero-length SGL to rdma_rw_ctx_init(), and it
oopses.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
 net/sunrpc/xprtrdma/svc_rdma_rw.c |    2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
index 12aa4c53b48f..0b63e1321d74 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
@@ -455,6 +455,8 @@  svc_rdma_build_writes(struct svc_rdma_write_info *info,
 			goto out_overflow;
 
 		write_len = min(remaining, seg->rs_length - info->wi_seg_off);
+		if (!write_len)
+			goto out_overflow;
 		ctxt = svc_rdma_get_rw_ctxt(rdma,
 					    (write_len >> PAGE_SHIFT) + 2);
 		if (!ctxt)