rbd: prevent kernel stack blow up on rbd map
commit 6d69bb536bac0d403d83db1ca841444981b280cd upstream. Mapping an image with a long parent chain (e.g. image foo, whose parent is bar, whose parent is baz, etc) currently leads to a kernel stack overflow, due to the following recursion in the reply path: rbd_osd_req_callback() rbd_obj_request_complete() rbd_img_obj_callback() rbd_img_parent_read_callback() rbd_obj_request_complete() ... Limit the parent chain to 16 images, which is ~5K worth of stack. When the above recursion is eliminated, this limit can be lifted. Fixes: http://tracker.ceph.com/issues/12538 Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Josh Durgin <jdurgin@redhat.com> [idryomov@gmail.com: backport to 3.10: rbd_dev->opts, context] Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
110dd0f8b0
commit
5ca84dac24
|
@ -93,6 +93,8 @@ static int atomic_dec_return_safe(atomic_t *v)
|
|||
|
||||
#define RBD_MINORS_PER_MAJOR 256 /* max minors per blkdev */
|
||||
|
||||
#define RBD_MAX_PARENT_CHAIN_LEN 16
|
||||
|
||||
#define RBD_SNAP_DEV_NAME_PREFIX "snap_"
|
||||
#define RBD_MAX_SNAP_NAME_LEN \
|
||||
(NAME_MAX - (sizeof (RBD_SNAP_DEV_NAME_PREFIX) - 1))
|
||||
|
@ -394,7 +396,7 @@ static ssize_t rbd_add(struct bus_type *bus, const char *buf,
|
|||
size_t count);
|
||||
static ssize_t rbd_remove(struct bus_type *bus, const char *buf,
|
||||
size_t count);
|
||||
static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping);
|
||||
static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth);
|
||||
static void rbd_spec_put(struct rbd_spec *spec);
|
||||
|
||||
static struct bus_attribute rbd_bus_attrs[] = {
|
||||
|
@ -4831,7 +4833,12 @@ out_err:
|
|||
return ret;
|
||||
}
|
||||
|
||||
static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
|
||||
/*
|
||||
* @depth is rbd_dev_image_probe() -> rbd_dev_probe_parent() ->
|
||||
* rbd_dev_image_probe() recursion depth, which means it's also the
|
||||
* length of the already discovered part of the parent chain.
|
||||
*/
|
||||
static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth)
|
||||
{
|
||||
struct rbd_device *parent = NULL;
|
||||
int ret;
|
||||
|
@ -4839,6 +4846,12 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
|
|||
if (!rbd_dev->parent_spec)
|
||||
return 0;
|
||||
|
||||
if (++depth > RBD_MAX_PARENT_CHAIN_LEN) {
|
||||
pr_info("parent chain is too long (%d)\n", depth);
|
||||
ret = -EINVAL;
|
||||
goto out_err;
|
||||
}
|
||||
|
||||
parent = rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec);
|
||||
if (!parent) {
|
||||
ret = -ENOMEM;
|
||||
|
@ -4852,7 +4865,7 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
|
|||
__rbd_get_client(rbd_dev->rbd_client);
|
||||
rbd_spec_get(rbd_dev->parent_spec);
|
||||
|
||||
ret = rbd_dev_image_probe(parent, false);
|
||||
ret = rbd_dev_image_probe(parent, depth);
|
||||
if (ret < 0)
|
||||
goto out_err;
|
||||
|
||||
|
@ -4969,7 +4982,7 @@ static void rbd_dev_image_release(struct rbd_device *rbd_dev)
|
|||
* parent), initiate a watch on its header object before using that
|
||||
* object to get detailed information about the rbd image.
|
||||
*/
|
||||
static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
|
||||
static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)
|
||||
{
|
||||
int ret;
|
||||
int tmp;
|
||||
|
@ -4990,7 +5003,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
|
|||
if (ret)
|
||||
goto err_out_format;
|
||||
|
||||
if (mapping) {
|
||||
if (!depth) {
|
||||
ret = rbd_dev_header_watch_sync(rbd_dev, true);
|
||||
if (ret)
|
||||
goto out_header_name;
|
||||
|
@ -5007,7 +5020,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
|
|||
if (ret)
|
||||
goto err_out_probe;
|
||||
|
||||
ret = rbd_dev_probe_parent(rbd_dev);
|
||||
ret = rbd_dev_probe_parent(rbd_dev, depth);
|
||||
if (ret)
|
||||
goto err_out_probe;
|
||||
|
||||
|
@ -5018,7 +5031,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
|
|||
err_out_probe:
|
||||
rbd_dev_unprobe(rbd_dev);
|
||||
err_out_watch:
|
||||
if (mapping) {
|
||||
if (!depth) {
|
||||
tmp = rbd_dev_header_watch_sync(rbd_dev, false);
|
||||
if (tmp)
|
||||
rbd_warn(rbd_dev, "unable to tear down "
|
||||
|
@ -5089,7 +5102,7 @@ static ssize_t rbd_add(struct bus_type *bus,
|
|||
rbdc = NULL; /* rbd_dev now owns this */
|
||||
spec = NULL; /* rbd_dev now owns this */
|
||||
|
||||
rc = rbd_dev_image_probe(rbd_dev, true);
|
||||
rc = rbd_dev_image_probe(rbd_dev, 0);
|
||||
if (rc < 0)
|
||||
goto err_out_rbd_dev;
|
||||
|
||||
|
|
Loading…
Reference in New Issue