diff options
| author | Xiubo Li <xiubli@redhat.com> | 2023-10-13 13:55:44 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-03-01 13:41:43 +0100 |
| commit | 136b4e1f6dad59945f18e7a3d90da572d3faa98b (patch) | |
| tree | 85e3de7d2b12b2170c4a81295ad7a94ed22373c3 /net | |
| parent | d793ca47796cf63d080f708b3de8da25b880db70 (diff) | |
| download | linux-stable-136b4e1f6dad59945f18e7a3d90da572d3faa98b.tar.gz linux-stable-136b4e1f6dad59945f18e7a3d90da572d3faa98b.tar.bz2 linux-stable-136b4e1f6dad59945f18e7a3d90da572d3faa98b.zip | |
libceph: fail sparse-read if the data length doesn't match
[ Upstream commit cd7d469c25704d414d71bf3644f163fb74e7996b ]
Once this happens that means there have bugs.
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ceph/osd_client.c | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c index 8d9760397b88..3babcd5e65e1 100644 --- a/net/ceph/osd_client.c +++ b/net/ceph/osd_client.c @@ -5856,8 +5856,8 @@ static int osd_sparse_read(struct ceph_connection *con, struct ceph_osd *o = con->private; struct ceph_sparse_read *sr = &o->o_sparse_read; u32 count = sr->sr_count; - u64 eoff, elen; - int ret; + u64 eoff, elen, len = 0; + int i, ret; switch (sr->sr_state) { case CEPH_SPARSE_READ_HDR: @@ -5909,8 +5909,20 @@ next_op: convert_extent_map(sr); ret = sizeof(sr->sr_datalen); *pbuf = (char *)&sr->sr_datalen; - sr->sr_state = CEPH_SPARSE_READ_DATA; + sr->sr_state = CEPH_SPARSE_READ_DATA_PRE; break; + case CEPH_SPARSE_READ_DATA_PRE: + /* Convert sr_datalen to host-endian */ + sr->sr_datalen = le32_to_cpu((__force __le32)sr->sr_datalen); + for (i = 0; i < count; i++) + len += sr->sr_extent[i].len; + if (sr->sr_datalen != len) { + pr_warn_ratelimited("data len %u != extent len %llu\n", + sr->sr_datalen, len); + return -EREMOTEIO; + } + sr->sr_state = CEPH_SPARSE_READ_DATA; + fallthrough; case CEPH_SPARSE_READ_DATA: if (sr->sr_index >= count) { sr->sr_state = CEPH_SPARSE_READ_HDR; |