Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1e5c6649 authored by Yan, Zheng's avatar Yan, Zheng Committed by Sage Weil
Browse files

ceph: check buffer size in ceph_vxattrcb_layout() 



If buffer size is zero, return the size of layout vxattr. If buffer
size is not zero, check if it is large enough for layout vxattr.

Signed-off-by: default avatarYan, Zheng <zheng.z.yan@intel.com>
parent 00bd8edb

fs/ceph/xattr.c

+25 −9
Original line number Diff line number Diff line
@@ -71,25 +71,41 @@ static size_t ceph_vxattrcb_layout(struct ceph_inode_info *ci, char *val, 
	struct ceph_osd_client *osdc = &fsc->client->osdc;

	s64 pool = ceph_file_layout_pg_pool(ci->i_layout);

	const char *pool_name;

	char buf[128];



	dout("ceph_vxattrcb_layout %p\n", &ci->vfs_inode);

	down_read(&osdc->map_sem);

	pool_name = ceph_pg_pool_name_by_id(osdc->osdmap, pool);

	if (pool_name)

		ret = snprintf(val, size,

		"stripe_unit=%lld stripe_count=%lld object_size=%lld pool=%s",

	if (pool_name) {

		size_t len = strlen(pool_name);

		ret = snprintf(buf, sizeof(buf),

		"stripe_unit=%lld stripe_count=%lld object_size=%lld pool=",

		(unsigned long long)ceph_file_layout_su(ci->i_layout),

		(unsigned long long)ceph_file_layout_stripe_count(ci->i_layout),

	        (unsigned long long)ceph_file_layout_object_size(ci->i_layout),

		pool_name);

	else

		ret = snprintf(val, size,

	        (unsigned long long)ceph_file_layout_object_size(ci->i_layout));

		if (!size) {

			ret += len;

		} else if (ret + len > size) {

			ret = -ERANGE;

		} else {

			memcpy(val, buf, ret);

			memcpy(val + ret, pool_name, len);

			ret += len;

		}

	} else {

		ret = snprintf(buf, sizeof(buf),

		"stripe_unit=%lld stripe_count=%lld object_size=%lld pool=%lld",

		(unsigned long long)ceph_file_layout_su(ci->i_layout),

		(unsigned long long)ceph_file_layout_stripe_count(ci->i_layout),

	        (unsigned long long)ceph_file_layout_object_size(ci->i_layout),

		(unsigned long long)pool);



		if (size) {

			if (ret <= size)

				memcpy(val, buf, ret);

			else

				ret = -ERANGE;

		}

	}

	up_read(&osdc->map_sem);

	return ret;

}