Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5435d206 authored by Dongsheng Yang's avatar Dongsheng Yang Committed by Ilya Dryomov
Browse files

rbd: fix response length parameter for encoded strings 



rbd_dev_image_id() allocates space for length but passes a smaller
value to rbd_obj_method_sync().  rbd_dev_v2_object_prefix() doesn't
allocate space for length.  Fix both to be consistent.

Signed-off-by: default avatarDongsheng Yang <dongsheng.yang@easystack.cn>
Reviewed-by: default avatarIlya Dryomov <idryomov@gmail.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent b8fe918b

drivers/block/rbd.c

+6 −4
Original line number Diff line number Diff line
@@ -5669,17 +5669,20 @@ static int rbd_dev_v2_image_size(struct rbd_device *rbd_dev) 


static int rbd_dev_v2_object_prefix(struct rbd_device *rbd_dev)

{

	size_t size;

	void *reply_buf;

	int ret;

	void *p;



	reply_buf = kzalloc(RBD_OBJ_PREFIX_LEN_MAX, GFP_KERNEL);

	/* Response will be an encoded string, which includes a length */

	size = sizeof(__le32) + RBD_OBJ_PREFIX_LEN_MAX;

	reply_buf = kzalloc(size, GFP_KERNEL);

	if (!reply_buf)

		return -ENOMEM;



	ret = rbd_obj_method_sync(rbd_dev, &rbd_dev->header_oid,

				  &rbd_dev->header_oloc, "get_object_prefix",

				  NULL, 0, reply_buf, RBD_OBJ_PREFIX_LEN_MAX);

				  NULL, 0, reply_buf, size);

	dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);

	if (ret < 0)

		goto out;
@@ -6696,7 +6699,6 @@ static int rbd_dev_image_id(struct rbd_device *rbd_dev) 
	dout("rbd id object name is %s\n", oid.name);



	/* Response will be an encoded string, which includes a length */



	size = sizeof (__le32) + RBD_IMAGE_ID_LEN_MAX;

	response = kzalloc(size, GFP_NOIO);

	if (!response) {
@@ -6708,7 +6710,7 @@ static int rbd_dev_image_id(struct rbd_device *rbd_dev) 


	ret = rbd_obj_method_sync(rbd_dev, &oid, &rbd_dev->header_oloc,

				  "get_id", NULL, 0,

				  response, RBD_IMAGE_ID_LEN_MAX);

				  response, size);

	dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);

	if (ret == -ENOENT) {

		image_id = kstrdup("", GFP_KERNEL);