Commit dff953ad authored Jul 23, 2019 by Luis Henriques Committed by Greg Kroah-Hartman Oct 11, 2019

ceph: fix directories inode i_blkbits initialization



[ Upstream commit 750670341a24cb714e624e0fd7da30900ad93752 ]

When filling an inode with info from the MDS, i_blkbits is being
initialized using fl_stripe_unit, which contains the stripe unit in
bytes.  Unfortunately, this doesn't make sense for directories as they
have fl_stripe_unit set to '0'.  This means that i_blkbits will be set
to 0xff, causing an UBSAN undefined behaviour in i_blocksize():

  UBSAN: Undefined behaviour in ./include/linux/fs.h:731:12
  shift exponent 255 is too large for 32-bit type 'int'

Fix this by initializing i_blkbits to CEPH_BLOCK_SHIFT if fl_stripe_unit
is zero.

Signed-off-by: Luis Henriques <lhenriques@suse.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 6c5207b5

fs/ceph/inode.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -789,7 +789,12 @@ static int fill_inode(struct inode inode, struct page locked_page,
		ci->i_version = le64_to_cpu(info->version);
		inode->i_version++;
		inode->i_rdev = le32_to_cpu(info->rdev);
		inode->i_blkbits = fls(le32_to_cpu(info->layout.fl_stripe_unit)) - 1;
		/* directories have fl_stripe_unit set to zero */
		if (le32_to_cpu(info->layout.fl_stripe_unit))
		inode->i_blkbits =
		fls(le32_to_cpu(info->layout.fl_stripe_unit)) - 1;
		else
		inode->i_blkbits = CEPH_BLOCK_SHIFT;

		if ((new_version \|\| (new_issued & CEPH_CAP_AUTH_SHARED)) &&
		(issued & CEPH_CAP_AUTH_EXCL) == 0) {