Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9e62bb44 authored by Boaz Harrosh's avatar Boaz Harrosh
Browse files

ore: Fix out-of-bounds access in _ios_obj() 



_ios_obj() is accessed by group_index not device_table index.

The oc->comps array is only a group_full of devices at a time
it is not like ore_comp_dev() which is indexed by a global
device_table index.

This did not BUG until now because exofs only uses a single
COMP for all devices. But with other FSs like PanFS this is
not true.

This bug was only in the write_path, all other users were
using it correctly

[This is a bug since 3.2 Kernel]
CC: Stable Tree <stable@kernel.org>

Signed-off-by: default avatarBoaz Harrosh <bharrosh@panasas.com>
parent be388f3d

fs/exofs/ore.c

+7 −7
Original line number Diff line number Diff line
@@ -837,11 +837,11 @@ static int _write_mirror(struct ore_io_state *ios, int cur_comp) 
				bio->bi_rw |= REQ_WRITE;

			}



			osd_req_write(or, _ios_obj(ios, dev), per_dev->offset,

				      bio, per_dev->length);

			osd_req_write(or, _ios_obj(ios, cur_comp),

				      per_dev->offset, bio, per_dev->length);

			ORE_DBGMSG("write(0x%llx) offset=0x%llx "

				      "length=0x%llx dev=%d\n",

				     _LLU(_ios_obj(ios, dev)->id),

				     _LLU(_ios_obj(ios, cur_comp)->id),

				     _LLU(per_dev->offset),

				     _LLU(per_dev->length), dev);

		} else if (ios->kern_buff) {
@@ -853,20 +853,20 @@ static int _write_mirror(struct ore_io_state *ios, int cur_comp) 
			       (ios->si.unit_off + ios->length >

				ios->layout->stripe_unit));



			ret = osd_req_write_kern(or, _ios_obj(ios, per_dev->dev),

			ret = osd_req_write_kern(or, _ios_obj(ios, cur_comp),

						 per_dev->offset,

						 ios->kern_buff, ios->length);

			if (unlikely(ret))

				goto out;

			ORE_DBGMSG2("write_kern(0x%llx) offset=0x%llx "

				      "length=0x%llx dev=%d\n",

				     _LLU(_ios_obj(ios, dev)->id),

				     _LLU(_ios_obj(ios, cur_comp)->id),

				     _LLU(per_dev->offset),

				     _LLU(ios->length), per_dev->dev);

		} else {

			osd_req_set_attributes(or, _ios_obj(ios, dev));

			osd_req_set_attributes(or, _ios_obj(ios, cur_comp));

			ORE_DBGMSG2("obj(0x%llx) set_attributes=%d dev=%d\n",

				     _LLU(_ios_obj(ios, dev)->id),

				     _LLU(_ios_obj(ios, cur_comp)->id),

				     ios->out_attr_len, dev);

		}