Ceph » RADOS

problem¶

1. function calc_op_budget return type is int，when indata.length() is out of int range, it will return a negative number.

int Objecter::calc_op_budget(const bc::small_vector_base<OSDOp>& ops)
{
  int op_budget = 0;
  for (auto i = ops.begin(); i != ops.end(); ++i) {
    if (i->op.op & CEPH_OSD_OP_MODE_WR) {
      op_budget += i->indata.length();
    } else if (ceph_osd_op_mode_read(i->op.op)) {
      if (ceph_osd_op_uses_extent(i->op.op)) {
        if ((int64_t)i->op.extent.length > 0)
          op_budget += (int64_t)i->op.extent.length;
      } else if (ceph_osd_op_type_attr(i->op.op)) {
        op_budget += i->op.xattr.name_len + i->op.xattr.value_len;
      }
    }
  }
  return op_budget;
}

void Objecter::_throttle_op(Op *op,
                shunique_lock<ceph::shared_mutex>& sul,
                int op_budget)
{
  ceph_assert(sul && sul.mutex() == &rwlock);
  bool locked_for_write = sul.owns_lock();

  if (!op_budget)
    op_budget = calc_op_budget(op->ops);
  if (!op_throttle_bytes.get_or_fail(op_budget)) { //couldn't take right now
    sul.unlock();
    op_throttle_bytes.get(op_budget);
    if (locked_for_write)
      sul.lock();
    else
      sul.lock_shared();
  }
  if (!op_throttle_ops.get_or_fail(1)) { //couldn't take right now
    sul.unlock();
    op_throttle_ops.get(1);
    if (locked_for_write)
      sul.lock();
    else
      sul.lock_shared();
  }
}

2. and negative value will fail at assert

bool Throttle::get_or_fail(int64_t c)
{
  if (0 == max) {
    return true;
  }

  assert (c >= 0); // will fail
  Mutex::Locker l(lock);
  ...
  ...
}

How to reproduce¶

1. rados set omap with a 3GB file

$ rados -p default.rgw.log setomapval  init.log key < 3GB.zip