Re: [PATCH] SUNRPC: Fix another issue with MIC buffer space

["Benjamin Coddington" <bcodding@redhat.com>]

On 15 Nov 2019, at 10:51, Chuck Lever wrote:

>> On Nov 15, 2019, at 9:35 AM, Benjamin Coddington 
>> <bcodding@redhat.com> wrote:
>>
>> On 15 Nov 2019, at 8:39, Chuck Lever wrote:
>>
>>> xdr_shrink_pagelen() BUG's when @len is larger than buf->page_len.
>>> This can happen when xdr_buf_read_mic() is given an xdr_buf with
>>> a small page array (like, only a few bytes).
>>
>> Hi Chuck,
>>
>> Seems like a bug in xdr_buf_read_mic to me, but I'm not seeing how 
>> this can
>> happen.. unless perhaps xdr->page_len is 0?  Or maybe xdr_shift_buf 
>> has bug?
>>
>> I'd prefer to keep the BUG_ON.  How can I reproduce it?
>>
>> diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
>> index 14ba9e72a204..71d754fc780e 100644
>> --- a/net/sunrpc/xdr.c
>> +++ b/net/sunrpc/xdr.c
>> @@ -1262,6 +1262,8 @@ int xdr_buf_read_mic(struct xdr_buf *buf, 
>> struct xdr_netobj *mic, unsigned int o
>>        if (offset < boundary && (offset + mic->len) > boundary)
>>                xdr_shift_buf(buf, boundary - offset);
>>
>> +       trace_printk("boundary %d, offset %d, page_len %d\n", 
>> boundary, offset, buf->page_len);
>> +
>
> Btw, I did some troubleshooting with a printk in here a couple days 
> ago:
>
> xdr_buf_read_mic: offset=136 boundary=142 buf->page_len=2

Ok, I see..  Your fix makes sense to me now, not much that 
xdr_buf_read_mic
can do about it, and we get rid of another BUG_ON site.

Reviewed-by: Benjamin Coddington <bcodding@redhat.com>

BTW that git regression test with disconnect injection is .. mean.  I
haven't hit the BUG_ON yet, but lots of:

[  171.770148] BUG: unable to handle page fault for address: 
ffff8880af767986
[  171.771752] #PF: supervisor read access in kernel mode
[  171.772552] #PF: error_code(0x0000) - not-present page
[  171.780214] RIP: 0010:kmem_cache_alloc+0x66/0x2d0

Ben