RDS: fix congestion map corruption for PAGE_SIZE > 4k

When PAGE_SIZE > 4k single page can contain 2 RDS fragments. If 'rds_ib_cong_recv' ignore the RDS fragment offset in to the page it then read the data fragment as far congestion map update and lead to corruption of the RDS connection far congestion map. Signed-off-by: Shamir Rabinovitch <[email protected]> Signed-off-by: David S. Miller <[email protected]>
oe5hpm · Apr 7, 2016 · 579ba85 · 579ba85
1 parent e98499a
commit 579ba85
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
@@ -796,7 +796,7 @@ static void rds_ib_cong_recv(struct rds_connection *conn,
 
 		addr = kmap_atomic(sg_page(&frag->f_sg));
 
-		src = addr + frag_off;
+		src = addr + frag->f_sg.offset + frag_off;
 		dst = (void *)map->m_page_addrs[map_page] + map_off;
 		for (k = 0; k < to_copy; k += 8) {
 			/* Record ports that became uncongested, ie