Commit e5decb2e authored by Chuck Lever's avatar Chuck Lever

svcrdma: Catch another Reply chunk overflow case

When space in the Reply chunk runs out in the middle of a segment,
we end up passing a zero-length SGL to rdma_rw_ctx_init(), and it
oopses.
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent b6505459
...@@ -460,6 +460,8 @@ svc_rdma_build_writes(struct svc_rdma_write_info *info, ...@@ -460,6 +460,8 @@ svc_rdma_build_writes(struct svc_rdma_write_info *info,
offset += info->wi_seg_off; offset += info->wi_seg_off;
write_len = min(remaining, length - info->wi_seg_off); write_len = min(remaining, length - info->wi_seg_off);
if (!write_len)
goto out_overflow;
ctxt = svc_rdma_get_rw_ctxt(rdma, ctxt = svc_rdma_get_rw_ctxt(rdma,
(write_len >> PAGE_SHIFT) + 2); (write_len >> PAGE_SHIFT) + 2);
if (!ctxt) if (!ctxt)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment