diff mbox series

[1/2] nbd: fix crash when the blksize is zero v2

Message ID 20190529201606.14903-2-mchristi@redhat.com (mailing list archive)
State New, archived
Headers show
Series nbd: block/dev size changes | expand

Commit Message

Mike Christie May 29, 2019, 8:16 p.m. UTC 
From: Xiubo Li <xiubli@redhat.com>

This will allow the blksize to be set zero and then use 1024 as
default.

Signed-off-by: Xiubo Li <xiubli@redhat.com>
[fix to use goto out instead of return in genl_connect]
Signed-off-by: Mike Christie <mchristi@redhat.com>
---

V2:
- Fix error handling in genl_connect.

 drivers/block/nbd.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

Comments

Xiubo Li May 30, 2019, 3:19 a.m. UTC | #1 
On 2019/5/30 4:16, Mike Christie wrote:
> From: Xiubo Li <xiubli@redhat.com>
>
> This will allow the blksize to be set zero and then use 1024 as
> default.
>
> Signed-off-by: Xiubo Li <xiubli@redhat.com>
> [fix to use goto out instead of return in genl_connect]
> Signed-off-by: Mike Christie <mchristi@redhat.com>
> ---
>
> V2:
> - Fix error handling in genl_connect.

This change looks good to me.

Thanks.
BRs
Xiubo



>   drivers/block/nbd.c | 23 ++++++++++++++++++++---
>   1 file changed, 20 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
> index 053958a8a2ba..236253fbf455 100644
> --- a/drivers/block/nbd.c
> +++ b/drivers/block/nbd.c
> @@ -135,6 +135,8 @@ static struct dentry *nbd_dbg_dir;
>   
>   #define NBD_MAGIC 0x68797548
>   
> +#define NBD_DEF_BLKSIZE 1024
> +
>   static unsigned int nbds_max = 16;
>   static int max_part = 16;
>   static struct workqueue_struct *recv_workqueue;
> @@ -1237,6 +1239,14 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
>   		nbd_config_put(nbd);
>   }
>   
> +static bool nbd_is_valid_blksize(unsigned long blksize)
> +{
> +	if (!blksize || !is_power_of_2(blksize) || blksize < 512 ||
> +	    blksize > PAGE_SIZE)
> +		return false;
> +	return true;
> +}
> +
>   /* Must be called with config_lock held */
>   static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
>   		       unsigned int cmd, unsigned long arg)
> @@ -1252,8 +1262,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
>   	case NBD_SET_SOCK:
>   		return nbd_add_socket(nbd, arg, false);
>   	case NBD_SET_BLKSIZE:
> -		if (!arg || !is_power_of_2(arg) || arg < 512 ||
> -		    arg > PAGE_SIZE)
> +		if (!arg)
> +			arg = NBD_DEF_BLKSIZE;
> +		if (!nbd_is_valid_blksize(arg))
>   			return -EINVAL;
>   		nbd_size_set(nbd, arg,
>   			     div_s64(config->bytesize, arg));
> @@ -1333,7 +1344,7 @@ static struct nbd_config *nbd_alloc_config(void)
>   	atomic_set(&config->recv_threads, 0);
>   	init_waitqueue_head(&config->recv_wq);
>   	init_waitqueue_head(&config->conn_wait);
> -	config->blksize = 1024;
> +	config->blksize = NBD_DEF_BLKSIZE;
>   	atomic_set(&config->live_connections, 0);
>   	try_module_get(THIS_MODULE);
>   	return config;
> @@ -1769,6 +1780,12 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
>   	if (info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]) {
>   		u64 bsize =
>   			nla_get_u64(info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]);
> +		if (!bsize)
> +			bsize = NBD_DEF_BLKSIZE;
> +		if (!nbd_is_valid_blksize(bsize)) {
> +			ret = -EINVAL;
> +			goto out;
> +		}
>   		nbd_size_set(nbd, bsize, div64_u64(config->bytesize, bsize));
>   	}
>   	if (info->attrs[NBD_ATTR_TIMEOUT]) {
Josef Bacik June 13, 2019, 4:56 p.m. UTC | #2 
On Wed, May 29, 2019 at 03:16:05PM -0500, Mike Christie wrote:
> From: Xiubo Li <xiubli@redhat.com>
> 
> This will allow the blksize to be set zero and then use 1024 as
> default.
> 
> Signed-off-by: Xiubo Li <xiubli@redhat.com>
> [fix to use goto out instead of return in genl_connect]
> Signed-off-by: Mike Christie <mchristi@redhat.com>
> ---

Sorry I missed this second go around

Reviewed-by: Josef Bacik <josef@toxicpanda.com>

Thanks,

Josef
diff mbox series

Patch

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 053958a8a2ba..236253fbf455 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -135,6 +135,8 @@  static struct dentry *nbd_dbg_dir;
 
 #define NBD_MAGIC 0x68797548
 
+#define NBD_DEF_BLKSIZE 1024
+
 static unsigned int nbds_max = 16;
 static int max_part = 16;
 static struct workqueue_struct *recv_workqueue;
@@ -1237,6 +1239,14 @@  static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
 		nbd_config_put(nbd);
 }
 
+static bool nbd_is_valid_blksize(unsigned long blksize)
+{
+	if (!blksize || !is_power_of_2(blksize) || blksize < 512 ||
+	    blksize > PAGE_SIZE)
+		return false;
+	return true;
+}
+
 /* Must be called with config_lock held */
 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
 		       unsigned int cmd, unsigned long arg)
@@ -1252,8 +1262,9 @@  static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
 	case NBD_SET_SOCK:
 		return nbd_add_socket(nbd, arg, false);
 	case NBD_SET_BLKSIZE:
-		if (!arg || !is_power_of_2(arg) || arg < 512 ||
-		    arg > PAGE_SIZE)
+		if (!arg)
+			arg = NBD_DEF_BLKSIZE;
+		if (!nbd_is_valid_blksize(arg))
 			return -EINVAL;
 		nbd_size_set(nbd, arg,
 			     div_s64(config->bytesize, arg));
@@ -1333,7 +1344,7 @@  static struct nbd_config *nbd_alloc_config(void)
 	atomic_set(&config->recv_threads, 0);
 	init_waitqueue_head(&config->recv_wq);
 	init_waitqueue_head(&config->conn_wait);
-	config->blksize = 1024;
+	config->blksize = NBD_DEF_BLKSIZE;
 	atomic_set(&config->live_connections, 0);
 	try_module_get(THIS_MODULE);
 	return config;
@@ -1769,6 +1780,12 @@  static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
 	if (info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]) {
 		u64 bsize =
 			nla_get_u64(info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]);
+		if (!bsize)
+			bsize = NBD_DEF_BLKSIZE;
+		if (!nbd_is_valid_blksize(bsize)) {
+			ret = -EINVAL;
+			goto out;
+		}
 		nbd_size_set(nbd, bsize, div64_u64(config->bytesize, bsize));
 	}
 	if (info->attrs[NBD_ATTR_TIMEOUT]) {