Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ef594c42 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client 

Pull Ceph fixes from Sage Weil:
 "Two fixes.

  One is a stopgap to prevent a stack blowout when users have a deep
  chain of image clones.  (We'll rewrite this code to be non-recursive
  for the next window, but in the meantime this is a simple fix that
  avoids a crash.)

  The second fixes a refcount underflow"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
  rbd: prevent kernel stack blow up on rbd map
  rbd: don't leak parent_spec in rbd_dev_probe_parent()
parents 37902bc1 6d69bb53

drivers/block/rbd.c

+39 −30
Original line number Original line Diff line number Diff line
@@ -96,6 +96,8 @@ static int atomic_dec_return_safe(atomic_t *v) 
#define RBD_MINORS_PER_MAJOR		256

#define RBD_MINORS_PER_MAJOR		256

#define RBD_SINGLE_MAJOR_PART_SHIFT	4

#define RBD_SINGLE_MAJOR_PART_SHIFT	4





#define RBD_MAX_PARENT_CHAIN_LEN	16



#define RBD_SNAP_DEV_NAME_PREFIX	"snap_"

#define RBD_SNAP_DEV_NAME_PREFIX	"snap_"

#define RBD_MAX_SNAP_NAME_LEN	\

#define RBD_MAX_SNAP_NAME_LEN	\

			(NAME_MAX - (sizeof (RBD_SNAP_DEV_NAME_PREFIX) - 1))

			(NAME_MAX - (sizeof (RBD_SNAP_DEV_NAME_PREFIX) - 1))
@@ -426,7 +428,7 @@ static ssize_t rbd_add_single_major(struct bus_type *bus, const char *buf, 
				    size_t count);

				    size_t count);

static ssize_t rbd_remove_single_major(struct bus_type *bus, const char *buf,

static ssize_t rbd_remove_single_major(struct bus_type *bus, const char *buf,

				       size_t count);

				       size_t count);

static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping);

static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth);

static void rbd_spec_put(struct rbd_spec *spec);

static void rbd_spec_put(struct rbd_spec *spec);





static int rbd_dev_id_to_minor(int dev_id)

static int rbd_dev_id_to_minor(int dev_id)
@@ -5131,44 +5133,51 @@ static int rbd_dev_v2_header_onetime(struct rbd_device *rbd_dev) 
	return ret;

	return ret;

}

}





static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)

/*

 * @depth is rbd_dev_image_probe() -> rbd_dev_probe_parent() ->

 * rbd_dev_image_probe() recursion depth, which means it's also the

 * length of the already discovered part of the parent chain.

 */

static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth)

{

{

	struct rbd_device *parent = NULL;

	struct rbd_device *parent = NULL;

	struct rbd_spec *parent_spec;

	struct rbd_client *rbdc;

	int ret;

	int ret;





	if (!rbd_dev->parent_spec)

	if (!rbd_dev->parent_spec)

		return 0;

		return 0;

	/*

	 * We need to pass a reference to the client and the parent

	 * spec when creating the parent rbd_dev.  Images related by

	 * parent/child relationships always share both.

	 */

	parent_spec = rbd_spec_get(rbd_dev->parent_spec);

	rbdc = __rbd_get_client(rbd_dev->rbd_client);





	if (++depth > RBD_MAX_PARENT_CHAIN_LEN) {

		pr_info("parent chain is too long (%d)\n", depth);

		ret = -EINVAL;

		goto out_err;

	}



	parent = rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec,

				NULL);

	if (!parent) {

		ret = -ENOMEM;

		ret = -ENOMEM;

	parent = rbd_dev_create(rbdc, parent_spec, NULL);

	if (!parent)

		goto out_err;

		goto out_err;

	}



	/*

	 * Images related by parent/child relationships always share

	 * rbd_client and spec/parent_spec, so bump their refcounts.

	 */

	__rbd_get_client(rbd_dev->rbd_client);

	rbd_spec_get(rbd_dev->parent_spec);





	ret = rbd_dev_image_probe(parent, false);

	ret = rbd_dev_image_probe(parent, depth);

	if (ret < 0)

	if (ret < 0)

		goto out_err;

		goto out_err;



	rbd_dev->parent = parent;

	rbd_dev->parent = parent;

	atomic_set(&rbd_dev->parent_ref, 1);

	atomic_set(&rbd_dev->parent_ref, 1);



	return 0;

	return 0;



out_err:

out_err:

	if (parent) {

	rbd_dev_unparent(rbd_dev);

	rbd_dev_unparent(rbd_dev);

	if (parent)

		rbd_dev_destroy(parent);

		rbd_dev_destroy(parent);

	} else {

		rbd_put_client(rbdc);

		rbd_spec_put(parent_spec);

	}



	return ret;

	return ret;

}

}
@@ -5286,7 +5295,7 @@ static void rbd_dev_image_release(struct rbd_device *rbd_dev) 
 * parent), initiate a watch on its header object before using that

 * parent), initiate a watch on its header object before using that

 * object to get detailed information about the rbd image.

 * object to get detailed information about the rbd image.

 */

 */

static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)

static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)

{

{

	int ret;

	int ret;
@@ -5304,7 +5313,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping) 
	if (ret)

	if (ret)

		goto err_out_format;

		goto err_out_format;





	if (mapping) {

	if (!depth) {

		ret = rbd_dev_header_watch_sync(rbd_dev);

		ret = rbd_dev_header_watch_sync(rbd_dev);

		if (ret) {

		if (ret) {

			if (ret == -ENOENT)

			if (ret == -ENOENT)
@@ -5325,7 +5334,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping) 
	 * Otherwise this is a parent image, identified by pool, image

	 * Otherwise this is a parent image, identified by pool, image

	 * and snap ids - need to fill in names for those ids.

	 * and snap ids - need to fill in names for those ids.

	 */

	 */

	if (mapping)

	if (!depth)

		ret = rbd_spec_fill_snap_id(rbd_dev);

		ret = rbd_spec_fill_snap_id(rbd_dev);

	else

	else

		ret = rbd_spec_fill_names(rbd_dev);

		ret = rbd_spec_fill_names(rbd_dev);
@@ -5347,12 +5356,12 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping) 
		 * Need to warn users if this image is the one being

		 * Need to warn users if this image is the one being

		 * mapped and has a parent.

		 * mapped and has a parent.

		 */

		 */

		if (mapping && rbd_dev->parent_spec)

		if (!depth && rbd_dev->parent_spec)

			rbd_warn(rbd_dev,

			rbd_warn(rbd_dev,

				 "WARNING: kernel layering is EXPERIMENTAL!");

				 "WARNING: kernel layering is EXPERIMENTAL!");

	}

	}





	ret = rbd_dev_probe_parent(rbd_dev);

	ret = rbd_dev_probe_parent(rbd_dev, depth);

	if (ret)

	if (ret)

		goto err_out_probe;

		goto err_out_probe;
@@ -5363,7 +5372,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping) 
err_out_probe:

err_out_probe:

	rbd_dev_unprobe(rbd_dev);

	rbd_dev_unprobe(rbd_dev);

err_out_watch:

err_out_watch:

	if (mapping)

	if (!depth)

		rbd_dev_header_unwatch_sync(rbd_dev);

		rbd_dev_header_unwatch_sync(rbd_dev);

out_header_name:

out_header_name:

	kfree(rbd_dev->header_name);

	kfree(rbd_dev->header_name);
@@ -5426,7 +5435,7 @@ static ssize_t do_rbd_add(struct bus_type *bus, 
	spec = NULL;		/* rbd_dev now owns this */

	spec = NULL;		/* rbd_dev now owns this */

	rbd_opts = NULL;	/* rbd_dev now owns this */

	rbd_opts = NULL;	/* rbd_dev now owns this */





	rc = rbd_dev_image_probe(rbd_dev, true);

	rc = rbd_dev_image_probe(rbd_dev, 0);

	if (rc < 0)

	if (rc < 0)

		goto err_out_rbd_dev;

		goto err_out_rbd_dev;