kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

nfs/blocklayout: Fix bad using of page offset in bl_read_pagelist

Browse source 
Blocklayout uses file offset for the read-back page's offset of first writing,
it's definitely wrong, it writes data to bad address of page that cause userspace
application segment fault. It must be the page base stored in header->args.pgbase.

Also, the pg_offset has no influence with isect and extent length.

Note: The offset of the non-first page is always zero.

Ps: A test program will segment fault at read() as,
#define _GNU_SOURCE

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>

int main(int argc, char **argv)
{
        char buf[2049];
        char *filename = NULL;
        int fd = -1;

        if (argc < 2) {
                printf("Usage: %s filename\n", argv[0]);
                return 0;
        }

        filename = argv[1];
        fd = open(filename, O_RDONLY | O_DIRECT);
        if (fd < 0) {
                printf("Open %s fail: %m\n", filename);
                return 1;
        }

        lseek(fd, 2048, SEEK_SET);
        if (read(fd, buf, sizeof(buf) - 1) != (sizeof(buf) - 1))
                printf("Read 4096 bityes data from %s fail: %m\n", filename);
out:
        close(fd);
        return 0;
}

Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
This commit is contained in:
Kinglong Mee 2015-10-16 17:22:50 +08:00 committed by Trond Myklebust
parent e0a63c0bfc
commit 15ae2c7bdc
1 changed files with 2 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
fs/nfs/blocklayout/blocklayout.c
View file

@ -229,7 +229,7 @@ bl_read_pagelist(struct nfs_pgio_header *header)
struct parallel_io *par; struct parallel_io *par;
loff_t f_offset = header->args.offset; loff_t f_offset = header->args.offset;
size_t bytes_left = header->args.count; size_t bytes_left = header->args.count;
unsigned int pg_offset, pg_len; unsigned int pg_offset = header->args.pgbase, pg_len;
struct page **pages = header->args.pages; struct page **pages = header->args.pages;
int pg_index = header->args.pgbase >> PAGE_CACHE_SHIFT; int pg_index = header->args.pgbase >> PAGE_CACHE_SHIFT;
const bool is_dio = (header->dreq != NULL); const bool is_dio = (header->dreq != NULL);
@ -262,7 +262,6 @@ bl_read_pagelist(struct nfs_pgio_header *header)
extent_length = be.be_length - (isect - be.be_f_offset); extent_length = be.be_length - (isect - be.be_f_offset);
} }
pg_offset = f_offset & ~PAGE_CACHE_MASK;
if (is_dio) { if (is_dio) {
if (pg_offset + bytes_left > PAGE_CACHE_SIZE) if (pg_offset + bytes_left > PAGE_CACHE_SIZE)
pg_len = PAGE_CACHE_SIZE - pg_offset; pg_len = PAGE_CACHE_SIZE - pg_offset;
@ -273,9 +272,6 @@ bl_read_pagelist(struct nfs_pgio_header *header)
pg_len = PAGE_CACHE_SIZE; pg_len = PAGE_CACHE_SIZE;
} }
isect += (pg_offset >> SECTOR_SHIFT);
extent_length -= (pg_offset >> SECTOR_SHIFT);
if (is_hole(&be)) { if (is_hole(&be)) {
bio = bl_submit_bio(READ, bio); bio = bl_submit_bio(READ, bio);
/* Fill hole w/ zeroes w/o accessing device */ /* Fill hole w/ zeroes w/o accessing device */
@ -301,6 +297,7 @@ bl_read_pagelist(struct nfs_pgio_header *header)
extent_length -= (pg_len >> SECTOR_SHIFT); extent_length -= (pg_len >> SECTOR_SHIFT);
f_offset += pg_len; f_offset += pg_len;
bytes_left -= pg_len; bytes_left -= pg_len;
pg_offset = 0;
} }
if ((isect << SECTOR_SHIFT) >= header->inode->i_size) { if ((isect << SECTOR_SHIFT) >= header->inode->i_size) {
header->res.eof = 1; header->res.eof = 1;