Commit 7f61f545 authored by Ilya Dryomov's avatar Ilya Dryomov
Browse files

libceph: don't access invalid memory in keepalive2 path 



This

    struct ceph_timespec ceph_ts;
    ...
    con_out_kvec_add(con, sizeof(ceph_ts), &ceph_ts);

wraps ceph_ts into a kvec and adds it to con->out_kvec array, yet
ceph_ts becomes invalid on return from prepare_write_keepalive().  As
a result, we send out bogus keepalive2 stamps.  Fix this by encoding
into a ceph_timespec member, similar to how acks are read and written.

Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
Reviewed-by: default avatarYan, Zheng <zyan@redhat.com>
parent 6ff33f39

include/linux/ceph/messenger.h

+3 −1
Original line number Diff line number Diff line
@@ -238,6 +238,8 @@ struct ceph_connection { 
	bool out_kvec_is_msg; /* kvec refers to out_msg */

	int out_more;        /* there is more data after the kvecs */

	__le64 out_temp_ack; /* for writing an ack */

	struct ceph_timespec out_temp_keepalive2; /* for writing keepalive2

						     stamp */



	/* message in temps */

	struct ceph_msg_header in_hdr;
@@ -248,7 +250,7 @@ struct ceph_connection { 
	int in_base_pos;     /* bytes read */

	__le64 in_temp_ack;  /* for reading an ack */



	struct timespec last_keepalive_ack;

	struct timespec last_keepalive_ack; /* keepalive2 ack stamp */



	struct delayed_work work;	    /* send|recv work */

	unsigned long       delay;          /* current delay interval */

net/ceph/messenger.c

+5 −4
Original line number Diff line number Diff line
@@ -1353,11 +1353,12 @@ static void prepare_write_keepalive(struct ceph_connection *con) 
	dout("prepare_write_keepalive %p\n", con);

	con_out_kvec_reset(con);

	if (con->peer_features & CEPH_FEATURE_MSGR_KEEPALIVE2) {

		struct timespec ts = CURRENT_TIME;

		struct ceph_timespec ceph_ts;

		ceph_encode_timespec(&ceph_ts, &ts);

		struct timespec now = CURRENT_TIME;



		con_out_kvec_add(con, sizeof(tag_keepalive2), &tag_keepalive2);

		con_out_kvec_add(con, sizeof(ceph_ts), &ceph_ts);

		ceph_encode_timespec(&con->out_temp_keepalive2, &now);

		con_out_kvec_add(con, sizeof(con->out_temp_keepalive2),

				 &con->out_temp_keepalive2);

	} else {

		con_out_kvec_add(con, sizeof(tag_keepalive), &tag_keepalive);

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE