Project

General

Profile

Actions
Copy link

Bug #10448

closed

wrong parameter passed to ceph_zero_pape_vector_range() in striped_read() of fs/ceph/file.c

Added by caifeng zhu over 9 years ago. Updated almost 8 years ago.

Status:
Resolved
Priority:
High
Assignee:
Zheng Yan
Category:
-
Target version:
-
% Done:

0%

Source:
Community (user)
Tags:
Backport:
Regression:
Severity:
2 - major
Reviewed:
Affected Versions:
ceph-qa-suite:
Component(FS):
kceph
Labels (FS):
Pull request ID:
Crash signature (v1):
Crash signature (v2):

Description

Hi, all

A bug is found in striped_read() of fs/ceph/file.c.
striped_read() calls ceph_zero_pape_vector_range() at line 359.
The first argument, page_align + read + ret, passed to ceph_zero_pape_vector_range()
is wrong.

When a file has holes, this wrong parameter may cause memory corruption either in kernal
space or user space. Kernel space memory may be corrupted in the case of non direct IO;
user space memory may be corrupted in the case of direct IO. In the latter case, the application
doing direct IO may crash due to memory corruption, as we have experienced.

The correct value should be initial_align + read + ret, where intial_align = o_direct ? buf_align : io_align.
Compared with page_align, the current page offest, initial_align is the initial page offest, which
should be used to calculate the page and offset in ceph_zero_pape_vector_range().

Best Regards!

Actions
Copy link

Also available in: Atom PDF