lkml.org 
[lkml]   [2012]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 37/82] ore: Fix out-of-bounds access in _ios_obj()
    Date
    From: Greg KH <gregkh@linuxfoundation.org>

    3.5-stable review patch. If anyone has any objections, please let me know.

    ------------------

    From: Boaz Harrosh <bharrosh@panasas.com>

    commit 9e62bb4458ad2cf28bd701aa5fab380b846db326 upstream.

    _ios_obj() is accessed by group_index not device_table index.

    The oc->comps array is only a group_full of devices at a time
    it is not like ore_comp_dev() which is indexed by a global
    device_table index.

    This did not BUG until now because exofs only uses a single
    COMP for all devices. But with other FSs like PanFS this is
    not true.

    This bug was only in the write_path, all other users were
    using it correctly

    [This is a bug since 3.2 Kernel]

    Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/exofs/ore.c | 14 +++++++-------
    1 file changed, 7 insertions(+), 7 deletions(-)

    --- a/fs/exofs/ore.c
    +++ b/fs/exofs/ore.c
    @@ -837,11 +837,11 @@ static int _write_mirror(struct ore_io_s
    bio->bi_rw |= REQ_WRITE;
    }

    - osd_req_write(or, _ios_obj(ios, dev), per_dev->offset,
    - bio, per_dev->length);
    + osd_req_write(or, _ios_obj(ios, cur_comp),
    + per_dev->offset, bio, per_dev->length);
    ORE_DBGMSG("write(0x%llx) offset=0x%llx "
    "length=0x%llx dev=%d\n",
    - _LLU(_ios_obj(ios, dev)->id),
    + _LLU(_ios_obj(ios, cur_comp)->id),
    _LLU(per_dev->offset),
    _LLU(per_dev->length), dev);
    } else if (ios->kern_buff) {
    @@ -853,20 +853,20 @@ static int _write_mirror(struct ore_io_s
    (ios->si.unit_off + ios->length >
    ios->layout->stripe_unit));

    - ret = osd_req_write_kern(or, _ios_obj(ios, per_dev->dev),
    + ret = osd_req_write_kern(or, _ios_obj(ios, cur_comp),
    per_dev->offset,
    ios->kern_buff, ios->length);
    if (unlikely(ret))
    goto out;
    ORE_DBGMSG2("write_kern(0x%llx) offset=0x%llx "
    "length=0x%llx dev=%d\n",
    - _LLU(_ios_obj(ios, dev)->id),
    + _LLU(_ios_obj(ios, cur_comp)->id),
    _LLU(per_dev->offset),
    _LLU(ios->length), per_dev->dev);
    } else {
    - osd_req_set_attributes(or, _ios_obj(ios, dev));
    + osd_req_set_attributes(or, _ios_obj(ios, cur_comp));
    ORE_DBGMSG2("obj(0x%llx) set_attributes=%d dev=%d\n",
    - _LLU(_ios_obj(ios, dev)->id),
    + _LLU(_ios_obj(ios, cur_comp)->id),
    ios->out_attr_len, dev);
    }




    \
     
     \ /
      Last update: 2012-08-14 02:22    [W:0.033 / U:31.864 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site