summaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorIlya Dryomov <idryomov@gmail.com>2015-09-14 16:01:05 +0300
committerIlya Dryomov <idryomov@gmail.com>2015-09-17 20:14:15 +0300
commit7f61f545657281a3a1b0faf68993165ebdecc51b (patch)
treed405e22c3eaeb3cb6071ca0fa46b4e8c7c909350 /include
parent6ff33f3902c3b1c5d0db6b1e2c70b6d76fba357f (diff)
downloadlinux-7f61f545657281a3a1b0faf68993165ebdecc51b.tar.bz2
libceph: don't access invalid memory in keepalive2 path
This struct ceph_timespec ceph_ts; ... con_out_kvec_add(con, sizeof(ceph_ts), &ceph_ts); wraps ceph_ts into a kvec and adds it to con->out_kvec array, yet ceph_ts becomes invalid on return from prepare_write_keepalive(). As a result, we send out bogus keepalive2 stamps. Fix this by encoding into a ceph_timespec member, similar to how acks are read and written. Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Yan, Zheng <zyan@redhat.com>
Diffstat (limited to 'include')
-rw-r--r--include/linux/ceph/messenger.h4
1 files changed, 3 insertions, 1 deletions
diff --git a/include/linux/ceph/messenger.h b/include/linux/ceph/messenger.h
index 7e1252e97a30..b2371d9b51fa 100644
--- a/include/linux/ceph/messenger.h
+++ b/include/linux/ceph/messenger.h
@@ -238,6 +238,8 @@ struct ceph_connection {
bool out_kvec_is_msg; /* kvec refers to out_msg */
int out_more; /* there is more data after the kvecs */
__le64 out_temp_ack; /* for writing an ack */
+ struct ceph_timespec out_temp_keepalive2; /* for writing keepalive2
+ stamp */
/* message in temps */
struct ceph_msg_header in_hdr;
@@ -248,7 +250,7 @@ struct ceph_connection {
int in_base_pos; /* bytes read */
__le64 in_temp_ack; /* for reading an ack */
- struct timespec last_keepalive_ack;
+ struct timespec last_keepalive_ack; /* keepalive2 ack stamp */
struct delayed_work work; /* send|recv work */
unsigned long delay; /* current delay interval */