LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Mike Christie <mchristi@redhat.com>
To: xiubli@redhat.com, josef@toxicpanda.com, axboe@kernel.dk,
	nbd@other.debian.org
Cc: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
	atumball@redhat.com
Subject: Re: [PATCH] nbd: fix crash when the blksize is zero
Date: Wed, 29 May 2019 13:55:20 -0500	[thread overview]
Message-ID: <5CEED598.7080703@redhat.com> (raw)
In-Reply-To: <20190527054438.13548-1-xiubli@redhat.com>

On 05/27/2019 12:44 AM, xiubli@redhat.com wrote:
> From: Xiubo Li <xiubli@redhat.com>
> 
> This will allow the blksize to be set zero and then use 1024 as
> default.
> 
> Signed-off-by: Xiubo Li <xiubli@redhat.com>
> ---
>  drivers/block/nbd.c | 21 ++++++++++++++++++---
>  1 file changed, 18 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
> index 053958a..4c1de1c 100644
> --- a/drivers/block/nbd.c
> +++ b/drivers/block/nbd.c
> @@ -135,6 +135,8 @@ struct nbd_cmd {
>  
>  #define NBD_MAGIC 0x68797548
>  
> +#define NBD_DEF_BLKSIZE 1024
> +
>  static unsigned int nbds_max = 16;
>  static int max_part = 16;
>  static struct workqueue_struct *recv_workqueue;
> @@ -1237,6 +1239,14 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
>  		nbd_config_put(nbd);
>  }
>  
> +static bool nbd_is_valid_blksize(unsigned long blksize)
> +{
> +	if (!blksize || !is_power_of_2(blksize) || blksize < 512 ||
> +		blksize > PAGE_SIZE)
> +		return false;
> +	return true;
> +}
> +
>  /* Must be called with config_lock held */
>  static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
>  		       unsigned int cmd, unsigned long arg)
> @@ -1252,8 +1262,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
>  	case NBD_SET_SOCK:
>  		return nbd_add_socket(nbd, arg, false);
>  	case NBD_SET_BLKSIZE:
> -		if (!arg || !is_power_of_2(arg) || arg < 512 ||
> -		    arg > PAGE_SIZE)
> +		if (!arg)
> +			arg = NBD_DEF_BLKSIZE;
> +		if (!nbd_is_valid_blksize(arg))
>  			return -EINVAL;
>  		nbd_size_set(nbd, arg,
>  			     div_s64(config->bytesize, arg));
> @@ -1333,7 +1344,7 @@ static struct nbd_config *nbd_alloc_config(void)
>  	atomic_set(&config->recv_threads, 0);
>  	init_waitqueue_head(&config->recv_wq);
>  	init_waitqueue_head(&config->conn_wait);
> -	config->blksize = 1024;
> +	config->blksize = NBD_DEF_BLKSIZE;
>  	atomic_set(&config->live_connections, 0);
>  	try_module_get(THIS_MODULE);
>  	return config;
> @@ -1769,6 +1780,10 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
>  	if (info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]) {
>  		u64 bsize =
>  			nla_get_u64(info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]);
> +		if (!bsize)
> +			bsize = NBD_DEF_BLKSIZE;
> +		if (!nbd_is_valid_blksize(bsize))
> +			return -EINVAL;

You can't only return here. You need to also drop the mutex, do
nbd_put, and drop config_refs reference.

Maybe you want to move this check to the beginning of the function with
the NBD_ATTR_SIZE_BYTES sanity check since the error handling is easier
there.


>  		nbd_size_set(nbd, bsize, div64_u64(config->bytesize, bsize));
>  	}
>  	if (info->attrs[NBD_ATTR_TIMEOUT]) {
> 


  parent reply	other threads:[~2019-05-29 18:55 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-05-27  5:44 xiubli
2019-05-29 13:50 ` Josef Bacik
2019-05-29 18:55 ` Mike Christie [this message]
2019-05-30  1:28   ` Xiubo Li

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=5CEED598.7080703@redhat.com \
    --to=mchristi@redhat.com \
    --cc=atumball@redhat.com \
    --cc=axboe@kernel.dk \
    --cc=josef@toxicpanda.com \
    --cc=linux-block@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nbd@other.debian.org \
    --cc=xiubli@redhat.com \
    --subject='Re: [PATCH] nbd: fix crash when the blksize is zero' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).