Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 51fc7ab4 authored by Jeff Layton's avatar Jeff Layton Committed by Ilya Dryomov
Browse files

libceph: fix watch_item_t decoding to use ceph_decode_entity_addr 



While we're in there, let's also fix up the decoder to do proper
bounds checking.

Signed-off-by: default avatarJeff Layton <jlayton@kernel.org>
Reviewed-by: default avatar"Yan, Zheng" <zyan@redhat.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent dcbc919a

net/ceph/osd_client.c

+13 −7
Original line number Diff line number Diff line
@@ -4914,20 +4914,26 @@ static int decode_watcher(void **p, void *end, struct ceph_watch_item *item) 
	ret = ceph_start_decoding(p, end, 2, "watch_item_t",

				  &struct_v, &struct_len);

	if (ret)

		return ret;

		goto bad;



	ret = -EINVAL;

	ceph_decode_copy_safe(p, end, &item->name, sizeof(item->name), bad);

	ceph_decode_64_safe(p, end, item->cookie, bad);

	ceph_decode_skip_32(p, end, bad); /* skip timeout seconds */



	ceph_decode_copy(p, &item->name, sizeof(item->name));

	item->cookie = ceph_decode_64(p);

	*p += 4; /* skip timeout_seconds */

	if (struct_v >= 2) {

		ceph_decode_copy(p, &item->addr, sizeof(item->addr));

		ceph_decode_addr(&item->addr);

		ret = ceph_decode_entity_addr(p, end, &item->addr);

		if (ret)

			goto bad;

	} else {

		ret = 0;

	}



	dout("%s %s%llu cookie %llu addr %s\n", __func__,

	     ENTITY_NAME(item->name), item->cookie,

	     ceph_pr_addr(&item->addr));

	return 0;

bad:

	return ret;

}



static int decode_watchers(void **p, void *end,