From: David Disseldorp <ddiss@suse.de>
To: ceph-devel@vger.kernel.org
Cc: elder@linaro.org, David Disseldorp <ddiss@suse.de>
Subject: [PATCH 1/2] rbd: fix invalid img_request dereference
Date: Thu, 1 Sep 2016 16:59:18 +0200 [thread overview]
Message-ID: <1472741959-1786-2-git-send-email-ddiss@suse.de> (raw)
In-Reply-To: <1472741959-1786-1-git-send-email-ddiss@suse.de>
To obtain the snap_id, rbd_osd_req_format_read() dereferences
rbd_obj_request->img_request if non-null. This should never happen in
the rbd_img_obj_exists_submit() call path, as stat_request->img_request
is invalid - it's overwritten by stat_request->obj_request, which is
stored in the same union.
Fixes: c5b5ef6c5 ("rbd: issue stat request before layered write")
Signed-off-by: David Disseldorp <ddiss@suse.de>
---
drivers/block/rbd.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 6c6519f..93d6200 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -1875,9 +1875,9 @@ static void rbd_osd_req_callback(struct ceph_osd_request *osd_req)
rbd_obj_request_complete(obj_request);
}
-static void rbd_osd_req_format_read(struct rbd_obj_request *obj_request)
+static void rbd_osd_req_format_read(struct rbd_obj_request *obj_request,
+ struct rbd_img_request *img_request)
{
- struct rbd_img_request *img_request = obj_request->img_request;
struct ceph_osd_request *osd_req = obj_request->osd_req;
if (img_request)
@@ -2420,7 +2420,7 @@ static void rbd_img_obj_request_fill(struct rbd_obj_request *obj_request,
if (op_type == OBJ_OP_WRITE || op_type == OBJ_OP_DISCARD)
rbd_osd_req_format_write(obj_request);
else
- rbd_osd_req_format_read(obj_request);
+ rbd_osd_req_format_read(obj_request, img_request);
}
/*
@@ -2877,7 +2877,11 @@ static int rbd_img_obj_exists_submit(struct rbd_obj_request *obj_request)
osd_req_op_init(stat_request->osd_req, 0, CEPH_OSD_OP_STAT, 0);
osd_req_op_raw_data_in_pages(stat_request->osd_req, 0, pages, size, 0,
false, false);
- rbd_osd_req_format_read(stat_request);
+ /*
+ * Use img_request from original obj_request - stat_request->img_request
+ * is invalid (in a union with stat_request->obj_request).
+ */
+ rbd_osd_req_format_read(stat_request, obj_request->img_request);
osdc = &rbd_dev->rbd_client->client->osdc;
ret = rbd_obj_request_submit(osdc, stat_request);
@@ -3242,7 +3246,7 @@ static int rbd_obj_method_sync(struct rbd_device *rbd_dev,
osd_req_op_cls_response_data_pages(obj_request->osd_req, 0,
obj_request->pages, inbound_size,
0, false, false);
- rbd_osd_req_format_read(obj_request);
+ rbd_osd_req_format_read(obj_request, obj_request->img_request);
ret = rbd_obj_request_submit(osdc, obj_request);
if (ret)
@@ -3448,7 +3452,7 @@ static int rbd_obj_read_sync(struct rbd_device *rbd_dev,
obj_request->length,
obj_request->offset & ~PAGE_MASK,
false, false);
- rbd_osd_req_format_read(obj_request);
+ rbd_osd_req_format_read(obj_request, obj_request->img_request);
ret = rbd_obj_request_submit(osdc, obj_request);
if (ret)
--
2.6.6
next prev parent reply other threads:[~2016-09-01 15:13 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-01 14:59 [PATCH 0/2] rbd_img_obj_exists_submit() fixes David Disseldorp
2016-09-01 14:59 ` David Disseldorp [this message]
2016-09-01 14:59 ` [PATCH 2/2] rbd: fix rbd_img_obj_exists_submit() error path David Disseldorp
2016-09-15 10:48 ` [PATCH 0/2] rbd_img_obj_exists_submit() fixes David Disseldorp
2016-09-15 11:53 ` Ilya Dryomov
2016-09-15 12:25 ` Alex Elder
2016-09-19 17:06 ` Ilya Dryomov
2016-09-19 22:25 ` David Disseldorp
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1472741959-1786-2-git-send-email-ddiss@suse.de \
--to=ddiss@suse.de \
--cc=ceph-devel@vger.kernel.org \
--cc=elder@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox