| From 02e37571f9e79022498fd0525c073b07e9d9ac69 Mon Sep 17 00:00:00 2001 |
| From: Jeff Layton <jlayton@kernel.org> |
| Date: Tue, 4 Aug 2020 12:31:56 -0400 |
| Subject: [PATCH] ceph: handle zero-length feature mask in session messages |
| |
| commit 02e37571f9e79022498fd0525c073b07e9d9ac69 upstream. |
| |
| Most session messages contain a feature mask, but the MDS will |
| routinely send a REJECT message with one that is zero-length. |
| |
| Commit 0fa8263367db ("ceph: fix endianness bug when handling MDS |
| session feature bits") fixed the decoding of the feature mask, |
| but failed to account for the MDS sending a zero-length feature |
| mask. This causes REJECT message decoding to fail. |
| |
| Skip trying to decode a feature mask if the word count is zero. |
| |
| Cc: stable@vger.kernel.org |
| URL: https://tracker.ceph.com/issues/46823 |
| Fixes: 0fa8263367db ("ceph: fix endianness bug when handling MDS session feature bits") |
| Signed-off-by: Jeff Layton <jlayton@kernel.org> |
| Reviewed-by: Ilya Dryomov <idryomov@gmail.com> |
| Tested-by: Patrick Donnelly <pdonnell@redhat.com> |
| Signed-off-by: Ilya Dryomov <idryomov@gmail.com> |
| |
| diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c |
| index 1095802ad9bd..4a26862d7667 100644 |
| --- a/fs/ceph/mds_client.c |
| +++ b/fs/ceph/mds_client.c |
| @@ -3358,8 +3358,10 @@ static void handle_session(struct ceph_mds_session *session, |
| goto bad; |
| /* version >= 3, feature bits */ |
| ceph_decode_32_safe(&p, end, len, bad); |
| - ceph_decode_64_safe(&p, end, features, bad); |
| - p += len - sizeof(features); |
| + if (len) { |
| + ceph_decode_64_safe(&p, end, features, bad); |
| + p += len - sizeof(features); |
| + } |
| } |
| |
| mutex_lock(&mdsc->mutex); |
| -- |
| 2.27.0 |
| |
