6972525 NFS RDMA doesn't always handle iovec structures correctly

4 files changed, 24 insertions, 9 deletions

diff --git a/usr/src/uts/common/fs/nfs/nfs3_srv.c b/usr/src/uts/common/fs/nfs/nfs3_srv.c
index c770f91f47..6c52d2d3fd 100644
--- a/usr/src/uts/common/fs/nfs/nfs3_srv.c
+++ b/usr/src/uts/common/fs/nfs/nfs3_srv.c
@@ -19,8 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
+ * Copyright (c) 1994, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 
 /* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
@@ -1012,8 +1011,13 @@ rfs3_read(READ3args *args, READ3res *resp, struct exportinfo *exi,
 		goto out;
 	}
 
-	if (args->wlist)
+	if (args->wlist) {
+		if (args->count > clist_len(args->wlist)) {
+			error = EINVAL;
+			goto out;
+		}
 		rdma_used = 1;
+	}
 
 	/* use loaned buffers for TCP */
 	loaned_buffers = (nfs_loaned_buffers && !rdma_used) ? 1 : 0;
diff --git a/usr/src/uts/common/fs/nfs/nfs4_srv.c b/usr/src/uts/common/fs/nfs/nfs4_srv.c
index 288faadf85..29a9d67497 100644
--- a/usr/src/uts/common/fs/nfs/nfs4_srv.c
+++ b/usr/src/uts/common/fs/nfs/nfs4_srv.c
@@ -3182,8 +3182,13 @@ rfs4_op_read(nfs_argop4 *argop, nfs_resop4 *resop, struct svc_req *req,
 		goto out;
 	}
 
-	if (args->wlist)
+	if (args->wlist) {
+		if (args->count > clist_len(args->wlist)) {
+			*cs->statusp = resp->status = NFS4ERR_INVAL;
+			goto out;
+		}
 		rdma_used = 1;
+	}
 
 	/* use loaned buffers for TCP */
 	loaned_buffers = (nfs_loaned_buffers && !rdma_used) ? 1 : 0;
diff --git a/usr/src/uts/common/fs/nfs/nfs_srv.c b/usr/src/uts/common/fs/nfs/nfs_srv.c
index 4d98017403..8ca8ee5d1d 100644
--- a/usr/src/uts/common/fs/nfs/nfs_srv.c
+++ b/usr/src/uts/common/fs/nfs/nfs_srv.c
@@ -19,8 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
+ * Copyright (c) 1994, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 
 /*
@@ -767,6 +766,11 @@ rfs_read(struct nfsreadargs *ra, struct nfsrdresult *rr,
 		mp = NULL;
 		rr->rr_mp = NULL;
 		(void) rdma_get_wchunk(req, &iov, ra->ra_wlist);
+		if (ra->ra_count > iov.iov_len) {
+			rr->rr_data = NULL;
+			rr->rr_status = NFSERR_INVAL;
+			goto done;
+		}
 	} else {
 		/*
 		 * mp will contain the data to be sent out in the read reply.
diff --git a/usr/src/uts/common/rpc/xdr_rdma.c b/usr/src/uts/common/rpc/xdr_rdma.c
index 6598178125..3e513b8149 100644
--- a/usr/src/uts/common/rpc/xdr_rdma.c
+++ b/usr/src/uts/common/rpc/xdr_rdma.c
@@ -710,7 +710,7 @@ xdrrdma_control(XDR *xdrs, int request, void *info)
 	rdma_wlist_conn_info_t *rwcip = NULL;
 	rdma_chunkinfo_lengths_t *rcilp = NULL;
 	struct uio *uiop;
-	struct clist	*rwl = NULL;
+	struct clist	*rwl = NULL, *first = NULL;
 	struct clist	*prev = NULL;
 
 	switch (request) {
@@ -789,6 +789,8 @@ xdrrdma_control(XDR *xdrs, int request, void *info)
 
 			for (i = 0; i < uiop->uio_iovcnt; i++) {
 				rwl = clist_alloc();
+				if (first == NULL)
+					first = rwl;
 				rwl->c_len = uiop->uio_iov[i].iov_len;
 				rwl->u.c_daddr =
 				    (uint64)(uintptr_t)
@@ -811,8 +813,8 @@ xdrrdma_control(XDR *xdrs, int request, void *info)
 			}
 
 			rwl->c_next = NULL;
-			xdrp->xp_wcl = rwl;
-			*(rcip->rci_clpp) = rwl;
+			xdrp->xp_wcl = first;
+			*(rcip->rci_clpp) = first;
 
 			break;