github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-05 21:15:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ceph: fix off by one bugs in unsafe_request_wait()

Browse Source 
[ Upstream commit 708c87168b ]

The "> max" tests should be ">= max" to prevent an out of bounds access
on the next lines.

Fixes: e1a4541ec0 ("ceph: flush the mdlog before waiting on unsafe reqs")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Stable-dep-of: 5bd76b8de5 ("ceph: fix NULL pointer dereference for req->r_session")
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dan Carpenter 2021-09-06 12:43:01 +03:00 committed by Greg Kroah-Hartman
parent 8a31ae7f77
commit 38993788f4
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fs/ceph/caps.c
View File

@ -2343,7 +2343,7 @@ static int unsafe_request_wait(struct inode *inode)
list_for_each_entry(req, &ci->i_unsafe_dirops, list_for_each_entry(req, &ci->i_unsafe_dirops,
r_unsafe_dir_item) { r_unsafe_dir_item) {
s = req->r_session; s = req->r_session;
if (unlikely(s->s_mds > max)) { if (unlikely(s->s_mds >= max)) {
spin_unlock(&ci->i_unsafe_lock); spin_unlock(&ci->i_unsafe_lock);
goto retry; goto retry;
} }
@ -2357,7 +2357,7 @@ static int unsafe_request_wait(struct inode *inode)
list_for_each_entry(req, &ci->i_unsafe_iops, list_for_each_entry(req, &ci->i_unsafe_iops,
r_unsafe_target_item) { r_unsafe_target_item) {
s = req->r_session; s = req->r_session;
if (unlikely(s->s_mds > max)) { if (unlikely(s->s_mds >= max)) {
spin_unlock(&ci->i_unsafe_lock); spin_unlock(&ci->i_unsafe_lock);
goto retry; goto retry;
} }