Searched hist:"98 c4bfe9" (Results 1 – 1 of 1) sorted by relevance
/openbmc/linux/net/ceph/ |
H A D | osd_client.c | 98c4bfe9 Wed Oct 17 07:23:04 CDT 2018 Ilya Dryomov <idryomov@gmail.com> libceph: check reply num_data_items in setup_request_data()
setup_request_data() adds message data items to both request and reply messages, but only checks request num_data_items before proceeding with the loop. This is wrong because if an op doesn't have any request data items but has a reply data item (e.g. read), a duplicate data item gets added to the message on every resend attempt.
This went unnoticed for years but now that message data items are preallocated, it promptly crashes in ceph_msg_data_add(). Amend the signature to make it clear that setup_request_data() operates on both request and reply messages. Also, remove data_len assert -- we have another one in prepare_write_message().
Signed-off-by: Ilya Dryomov <idryomov@gmail.com> 98c4bfe9 Wed Oct 17 07:23:04 CDT 2018 Ilya Dryomov <idryomov@gmail.com> libceph: check reply num_data_items in setup_request_data() setup_request_data() adds message data items to both request and reply messages, but only checks request num_data_items before proceeding with the loop. This is wrong because if an op doesn't have any request data items but has a reply data item (e.g. read), a duplicate data item gets added to the message on every resend attempt. This went unnoticed for years but now that message data items are preallocated, it promptly crashes in ceph_msg_data_add(). Amend the signature to make it clear that setup_request_data() operates on both request and reply messages. Also, remove data_len assert -- we have another one in prepare_write_message(). Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
|