xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ceph: fix off by one bugs in unsafe_request_wait()

Browse Source 
[ Upstream commit 708c87168b6121abc74b2a57d0c498baaf70cbea ]

The "> max" tests should be ">= max" to prevent an out of bounds access
on the next lines.

Fixes: e1a4541ec0b9 ("ceph: flush the mdlog before waiting on unsafe reqs")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Stable-dep-of: 5bd76b8de5b7 ("ceph: fix NULL pointer dereference for req->r_session")
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dan Carpenter
2021-09-06 12:43:01 +03:00
committed by Greg Kroah-Hartman
parent 8a31ae7f77
commit 38993788f4
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
fs/ceph/caps.c
View File

@@ -2343,7 +2343,7 @@ retry:
list_for_each_entry(req, &ci->i_unsafe_dirops, list_for_each_entry(req, &ci->i_unsafe_dirops,
r_unsafe_dir_item) { r_unsafe_dir_item) {
s = req->r_session; s = req->r_session;
if (unlikely(s->s_mds > max)) { if (unlikely(s->s_mds >= max)) {
spin_unlock(&ci->i_unsafe_lock); spin_unlock(&ci->i_unsafe_lock);
goto retry; goto retry;
} }
@@ -2357,7 +2357,7 @@ retry:
list_for_each_entry(req, &ci->i_unsafe_iops, list_for_each_entry(req, &ci->i_unsafe_iops,
r_unsafe_target_item) { r_unsafe_target_item) {
s = req->r_session; s = req->r_session;
if (unlikely(s->s_mds > max)) { if (unlikely(s->s_mds >= max)) {
spin_unlock(&ci->i_unsafe_lock); spin_unlock(&ci->i_unsafe_lock);
goto retry; goto retry;
} }