From: Xiubo Li <xiubli@xxxxxxxxxx> When the MClientSnap reqeust's op is not CEPH_SNAP_OP_SPLIT the request may still contain a list of 'split_realms', and we need to skip it anyway. Or it will be parsed as a corrupt snaptrace. Cc: stable@xxxxxxxxxxxxxxx Cc: Frank Schilder <frans@xxxxxx> Reported-by: Frank Schilder <frans@xxxxxx> URL: https://tracker.ceph.com/issues/61200 Signed-off-by: Xiubo Li <xiubli@xxxxxxxxxx> --- V2: - Add a detail comment for the code. fs/ceph/snap.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c index 0e59e95a96d9..0f00f977c0f0 100644 --- a/fs/ceph/snap.c +++ b/fs/ceph/snap.c @@ -1114,6 +1114,19 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc, continue; adjust_snap_realm_parent(mdsc, child, realm->ino); } + } else { + /* + * In non-SPLIT op case both the 'num_split_inos' and + * 'num_split_realms' should always be 0 and this will + * do nothing. But the MDS has one bug that in one of + * the UPDATE op cases it will pass a 'split_realms' + * list by mistake, and then will corrupted the snap + * trace in ceph_update_snap_trace(). + * + * So we should skip them anyway here. + */ + p += sizeof(u64) * num_split_inos; + p += sizeof(u64) * num_split_realms; } /* -- 2.40.1
