Commit 7f61f545 authored by Ilya Dryomov's avatar Ilya Dryomov

libceph: don't access invalid memory in keepalive2 path

This

    struct ceph_timespec ceph_ts;
    ...
    con_out_kvec_add(con, sizeof(ceph_ts), &ceph_ts);

wraps ceph_ts into a kvec and adds it to con->out_kvec array, yet
ceph_ts becomes invalid on return from prepare_write_keepalive().  As
a result, we send out bogus keepalive2 stamps.  Fix this by encoding
into a ceph_timespec member, similar to how acks are read and written.
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
Reviewed-by: default avatarYan, Zheng <zyan@redhat.com>
parent 6ff33f39
...@@ -238,6 +238,8 @@ struct ceph_connection { ...@@ -238,6 +238,8 @@ struct ceph_connection {
bool out_kvec_is_msg; /* kvec refers to out_msg */ bool out_kvec_is_msg; /* kvec refers to out_msg */
int out_more; /* there is more data after the kvecs */ int out_more; /* there is more data after the kvecs */
__le64 out_temp_ack; /* for writing an ack */ __le64 out_temp_ack; /* for writing an ack */
struct ceph_timespec out_temp_keepalive2; /* for writing keepalive2
stamp */
/* message in temps */ /* message in temps */
struct ceph_msg_header in_hdr; struct ceph_msg_header in_hdr;
...@@ -248,7 +250,7 @@ struct ceph_connection { ...@@ -248,7 +250,7 @@ struct ceph_connection {
int in_base_pos; /* bytes read */ int in_base_pos; /* bytes read */
__le64 in_temp_ack; /* for reading an ack */ __le64 in_temp_ack; /* for reading an ack */
struct timespec last_keepalive_ack; struct timespec last_keepalive_ack; /* keepalive2 ack stamp */
struct delayed_work work; /* send|recv work */ struct delayed_work work; /* send|recv work */
unsigned long delay; /* current delay interval */ unsigned long delay; /* current delay interval */
......
...@@ -1353,11 +1353,12 @@ static void prepare_write_keepalive(struct ceph_connection *con) ...@@ -1353,11 +1353,12 @@ static void prepare_write_keepalive(struct ceph_connection *con)
dout("prepare_write_keepalive %p\n", con); dout("prepare_write_keepalive %p\n", con);
con_out_kvec_reset(con); con_out_kvec_reset(con);
if (con->peer_features & CEPH_FEATURE_MSGR_KEEPALIVE2) { if (con->peer_features & CEPH_FEATURE_MSGR_KEEPALIVE2) {
struct timespec ts = CURRENT_TIME; struct timespec now = CURRENT_TIME;
struct ceph_timespec ceph_ts;
ceph_encode_timespec(&ceph_ts, &ts);
con_out_kvec_add(con, sizeof(tag_keepalive2), &tag_keepalive2); con_out_kvec_add(con, sizeof(tag_keepalive2), &tag_keepalive2);
con_out_kvec_add(con, sizeof(ceph_ts), &ceph_ts); ceph_encode_timespec(&con->out_temp_keepalive2, &now);
con_out_kvec_add(con, sizeof(con->out_temp_keepalive2),
&con->out_temp_keepalive2);
} else { } else {
con_out_kvec_add(con, sizeof(tag_keepalive), &tag_keepalive); con_out_kvec_add(con, sizeof(tag_keepalive), &tag_keepalive);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment