p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ceph: properly zero data pages for file holes. 

A bug is found in striped_read() of fs/ceph/file.c. striped_read() calls
ceph_zero_pape_vector_range().  The first argument, page_align + read + ret,
passed to ceph_zero_pape_vector_range() is wrong.

When a file has holes, this wrong parameter may cause memory corruption
either in kernal space or user space. Kernel space memory may be corrupted in
the case of non direct IO; user space memory may be corrupted in the case of
direct IO. In the latter case, the application doing direct IO may crash due
to memory corruption, as we have experienced.

The correct value should be initial_align + read + ret, where intial_align =
o_direct ? buf_align : io_align.  Compared with page_align, the current page
offest, initial_align is the initial page offest, which should be used to
calculate the page and offset in ceph_zero_pape_vector_range().

Reported-by: caifeng zhu <zhucaifeng@unissoft-nj.com>
Signed-off-by: Yan, Zheng <zyan@redhat.com>
This commit is contained in:
Yan, Zheng 2015-01-06 15:29:14 +08:00 committed by Ilya Dryomov
parent 671762f807
commit 1487a688d8
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
fs/ceph/file.c
View File

@ -392,13 +392,14 @@ static int striped_read(struct inode *inode,
if (ret >= 0) {
int didpages;
if (was_short && (pos + ret < inode->i_size)) {
u64 tmp = min(this_len - ret,
inode->i_size - pos - ret);
int zlen = min(this_len - ret,
inode->i_size - pos - ret);
int zoff = (o_direct ? buf_align : io_align) +
read + ret;
dout(" zero gap %llu to %llu\n",
pos + ret, pos + ret + tmp);
ceph_zero_page_vector_range(page_align + read + ret,
tmp, pages);
ret += tmp;
pos + ret, pos + ret + zlen);
ceph_zero_page_vector_range(zoff, zlen, pages);
ret += zlen;
}
didpages = (page_align + ret) >> PAGE_CACHE_SHIFT;