On Fri, 8 Aug 2014, Ilya Dryomov wrote:
> Determining ->last_piece based on the value of ->page_offset + length
> is incorrect because length here is the length of the entire message.
> ->last_piece set to false even if page array data item length is <=
> PAGE_SIZE, which results in invalid length passed to
> ceph_tcp_{send,recv}page() and causes various asserts to fire.
>
> # cat pages-cursor-init.sh
> #!/bin/bash
> rbd create --size 10 --image-format 2 foo
> FOO_DEV=$(rbd map foo)
> dd if=/dev/urandom of=$FOO_DEV bs=1M &>/dev/null
> rbd snap create foo@snap
> rbd snap protect foo@snap
> rbd clone foo@snap bar
> # rbd_resize calls librbd rbd_resize(), size is in bytes
> ./rbd_resize bar $(((4 << 20) + 512))
> rbd resize --size 10 bar
> BAR_DEV=$(rbd map bar)
> # trigger a 512-byte copyup -- 512-byte page array data item
> dd if=/dev/urandom of=$BAR_DEV bs=1M count=1 seek=5
>
> The problem exists only in ceph_msg_data_pages_cursor_init(),
> ceph_msg_data_pages_advance() does the right thing. The size_t cast is
> unnecessary.
>
> Signed-off-by: Ilya Dryomov <ilya.dryomov@xxxxxxxxxxx>
Looks good!
Reviewed-by: Sage Weil <sage@xxxxxxxxxx>
> ---
> net/ceph/messenger.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
> index e51cad0db580..b2f571dd933d 100644
> --- a/net/ceph/messenger.c
> +++ b/net/ceph/messenger.c
> @@ -901,7 +901,7 @@ static void ceph_msg_data_pages_cursor_init(struct ceph_msg_data_cursor *cursor,
> BUG_ON(page_count > (int)USHRT_MAX);
> cursor->page_count = (unsigned short)page_count;
> BUG_ON(length > SIZE_MAX - cursor->page_offset);
> - cursor->last_piece = (size_t)cursor->page_offset + length <= PAGE_SIZE;
> + cursor->last_piece = cursor->page_offset + cursor->resid <= PAGE_SIZE;
> }
>
> static struct page *
> --
> 1.7.10.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
>
--
To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
