diff options
| author | Yan, Zheng <zyan@redhat.com> | 2018-08-03 16:24:49 +0800 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2018-08-13 17:55:44 +0200 |
| commit | 0fcf6c02b205f80f24eb548b236543ec151cb01c (patch) | |
| tree | b6995a6a5a7ca79d2d9d0f1c728f63cda66bbe6a /fs/ceph/mds_client.c | |
| parent | 342ce1823ebaec573ac269b56bca78c698fec5c3 (diff) | |
ceph: don't drop message if it contains more data than expected
Later version mds may encode more data into messages.
Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'fs/ceph/mds_client.c')
| -rw-r--r-- | fs/ceph/mds_client.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 5b767cf1f780..bc43c822426a 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -3406,10 +3406,10 @@ static void handle_lease(struct ceph_mds_client *mdsc, vino.ino = le64_to_cpu(h->ino); vino.snap = CEPH_NOSNAP; seq = le32_to_cpu(h->seq); - dname.name = (void *)h + sizeof(*h) + sizeof(u32); - dname.len = msg->front.iov_len - sizeof(*h) - sizeof(u32); - if (dname.len != get_unaligned_le32(h+1)) + dname.len = get_unaligned_le32(h + 1); + if (msg->front.iov_len < sizeof(*h) + sizeof(u32) + dname.len) goto bad; + dname.name = (void *)(h + 1) + sizeof(u32); /* lookup inode */ inode = ceph_find_inode(sb, vino); |