Messages in this thread | | | Subject | Re: [PATCH] nbd: fix crash when the blksize is zero | From | Xiubo Li <> | Date | Thu, 30 May 2019 09:28:07 +0800 |
| |
On 2019/5/30 2:55, Mike Christie wrote: > On 05/27/2019 12:44 AM, xiubli@redhat.com wrote: >> From: Xiubo Li <xiubli@redhat.com> >> >> This will allow the blksize to be set zero and then use 1024 as >> default. >> >> Signed-off-by: Xiubo Li <xiubli@redhat.com> >> --- >> drivers/block/nbd.c | 21 ++++++++++++++++++--- >> 1 file changed, 18 insertions(+), 3 deletions(-) >> >> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c >> index 053958a..4c1de1c 100644 >> --- a/drivers/block/nbd.c >> +++ b/drivers/block/nbd.c >> @@ -135,6 +135,8 @@ struct nbd_cmd { >> >> #define NBD_MAGIC 0x68797548 >> >> +#define NBD_DEF_BLKSIZE 1024 >> + >> static unsigned int nbds_max = 16; >> static int max_part = 16; >> static struct workqueue_struct *recv_workqueue; >> @@ -1237,6 +1239,14 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd, >> nbd_config_put(nbd); >> } >> >> +static bool nbd_is_valid_blksize(unsigned long blksize) >> +{ >> + if (!blksize || !is_power_of_2(blksize) || blksize < 512 || >> + blksize > PAGE_SIZE) >> + return false; >> + return true; >> +} >> + >> /* Must be called with config_lock held */ >> static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, >> unsigned int cmd, unsigned long arg) >> @@ -1252,8 +1262,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, >> case NBD_SET_SOCK: >> return nbd_add_socket(nbd, arg, false); >> case NBD_SET_BLKSIZE: >> - if (!arg || !is_power_of_2(arg) || arg < 512 || >> - arg > PAGE_SIZE) >> + if (!arg) >> + arg = NBD_DEF_BLKSIZE; >> + if (!nbd_is_valid_blksize(arg)) >> return -EINVAL; >> nbd_size_set(nbd, arg, >> div_s64(config->bytesize, arg)); >> @@ -1333,7 +1344,7 @@ static struct nbd_config *nbd_alloc_config(void) >> atomic_set(&config->recv_threads, 0); >> init_waitqueue_head(&config->recv_wq); >> init_waitqueue_head(&config->conn_wait); >> - config->blksize = 1024; >> + config->blksize = NBD_DEF_BLKSIZE; >> atomic_set(&config->live_connections, 0); >> try_module_get(THIS_MODULE); >> return config; >> @@ -1769,6 +1780,10 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) >> if (info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]) { >> u64 bsize = >> nla_get_u64(info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]); >> + if (!bsize) >> + bsize = NBD_DEF_BLKSIZE; >> + if (!nbd_is_valid_blksize(bsize)) >> + return -EINVAL; > You can't only return here. You need to also drop the mutex, do > nbd_put, and drop config_refs reference. > > Maybe you want to move this check to the beginning of the function with > the NBD_ATTR_SIZE_BYTES sanity check since the error handling is easier > there.
Yeah, right.
I saw your resend patch of this and that looks good to me.
Thanks BRs Xiubo
> >> nbd_size_set(nbd, bsize, div64_u64(config->bytesize, bsize)); >> } >> if (info->attrs[NBD_ATTR_TIMEOUT]) { >>
| |