• Yan, Zheng's avatar
    ceph: properly zero data pages for file holes. · 1487a688
    Yan, Zheng authored
    A bug is found in striped_read() of fs/ceph/file.c. striped_read() calls
    ceph_zero_pape_vector_range().  The first argument, page_align + read + ret,
    passed to ceph_zero_pape_vector_range() is wrong.
    
    When a file has holes, this wrong parameter may cause memory corruption
    either in kernal space or user space. Kernel space memory may be corrupted in
    the case of non direct IO; user space memory may be corrupted in the case of
    direct IO. In the latter case, the application doing direct IO may crash due
    to memory corruption, as we have experienced.
    
    The correct value should be initial_align + read + ret, where intial_align =
    o_direct ? buf_align : io_align.  Compared with page_align, the current page
    offest, initial_align is the initial page offest, which should be used to
    calculate the page and offset in ceph_zero_pape_vector_range().
    Reported-by: default avatarcaifeng zhu <zhucaifeng@unissoft-nj.com>
    Signed-off-by: default avatarYan, Zheng <zyan@redhat.com>
    1487a688
file.c 34.5 KB