Skip to content

Commit

Permalink
ceph: canonicalize server path in place
Browse files Browse the repository at this point in the history
commit b27a939 upstream.

syzbot reported that 4fbc0c7 ("ceph: remove the extra slashes in
the server path") had caused a regression where an allocation could be
done under a spinlock -- compare_mount_options() is called by sget_fc()
with sb_lock held.

We don't really need the supplied server path, so canonicalize it
in place and compare it directly.  To make this work, the leading
slash is kept around and the logic in ceph_real_mount() to skip it
is restored.  CEPH_MSG_CLIENT_SESSION now reports the same (i.e.
canonicalized) path, with the leading slash of course.

Fixes: 4fbc0c7 ("ceph: remove the extra slashes in the server path")
Reported-by: [email protected]
Signed-off-by: Ilya Dryomov <[email protected]>
Reviewed-by: Jeff Layton <[email protected]>
Signed-off-by: Luis Henriques <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
idryomov authored and gregkh committed Apr 13, 2020
1 parent 68d8766 commit 1cccf9d
Showing 2 changed files with 28 additions and 92 deletions.
118 changes: 27 additions & 91 deletions fs/ceph/super.c
Original file line number Diff line number Diff line change
@@ -177,6 +177,26 @@ static match_table_t fsopt_tokens = {
{-1, NULL}
};

/*
* Remove adjacent slashes and then the trailing slash, unless it is
* the only remaining character.
*
* E.g. "//dir1////dir2///" --> "/dir1/dir2", "///" --> "/".
*/
static void canonicalize_path(char *path)
{
int i, j = 0;

for (i = 0; path[i] != '\0'; i++) {
if (path[i] != '/' || j < 1 || path[j - 1] != '/')
path[j++] = path[i];
}

if (j > 1 && path[j - 1] == '/')
j--;
path[j] = '\0';
}

static int parse_fsopt_token(char *c, void *private)
{
struct ceph_mount_options *fsopt = private;
@@ -320,81 +340,13 @@ static int strcmp_null(const char *s1, const char *s2)
return strcmp(s1, s2);
}

/**
* path_remove_extra_slash - Remove the extra slashes in the server path
* @server_path: the server path and could be NULL
*
* Return NULL if the path is NULL or only consists of "/", or a string
* without any extra slashes including the leading slash(es) and the
* slash(es) at the end of the server path, such as:
* "//dir1////dir2///" --> "dir1/dir2"
*/
static char *path_remove_extra_slash(const char *server_path)
{
const char *path = server_path;
const char *cur, *end;
char *buf, *p;
int len;

/* if the server path is omitted */
if (!path)
return NULL;

/* remove all the leading slashes */
while (*path == '/')
path++;

/* if the server path only consists of slashes */
if (*path == '\0')
return NULL;

len = strlen(path);

buf = kmalloc(len + 1, GFP_KERNEL);
if (!buf)
return ERR_PTR(-ENOMEM);

end = path + len;
p = buf;
do {
cur = strchr(path, '/');
if (!cur)
cur = end;

len = cur - path;

/* including one '/' */
if (cur != end)
len += 1;

memcpy(p, path, len);
p += len;

while (cur <= end && *cur == '/')
cur++;
path = cur;
} while (path < end);

*p = '\0';

/*
* remove the last slash if there has and just to make sure that
* we will get something like "dir1/dir2"
*/
if (*(--p) == '/')
*p = '\0';

return buf;
}

static int compare_mount_options(struct ceph_mount_options *new_fsopt,
struct ceph_options *new_opt,
struct ceph_fs_client *fsc)
{
struct ceph_mount_options *fsopt1 = new_fsopt;
struct ceph_mount_options *fsopt2 = fsc->mount_options;
int ofs = offsetof(struct ceph_mount_options, snapdir_name);
char *p1, *p2;
int ret;

ret = memcmp(fsopt1, fsopt2, ofs);
@@ -404,21 +356,12 @@ static int compare_mount_options(struct ceph_mount_options *new_fsopt,
ret = strcmp_null(fsopt1->snapdir_name, fsopt2->snapdir_name);
if (ret)
return ret;

ret = strcmp_null(fsopt1->mds_namespace, fsopt2->mds_namespace);
if (ret)
return ret;

p1 = path_remove_extra_slash(fsopt1->server_path);
if (IS_ERR(p1))
return PTR_ERR(p1);
p2 = path_remove_extra_slash(fsopt2->server_path);
if (IS_ERR(p2)) {
kfree(p1);
return PTR_ERR(p2);
}
ret = strcmp_null(p1, p2);
kfree(p1);
kfree(p2);
ret = strcmp_null(fsopt1->server_path, fsopt2->server_path);
if (ret)
return ret;

@@ -482,6 +425,8 @@ static int parse_mount_options(struct ceph_mount_options **pfsopt,
err = -ENOMEM;
goto out;
}

canonicalize_path(fsopt->server_path);
} else {
dev_name_end = dev_name + strlen(dev_name);
}
@@ -903,29 +848,20 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc)
mutex_lock(&fsc->client->mount_mutex);

if (!fsc->sb->s_root) {
const char *path, *p;
const char *path = fsc->mount_options->server_path ?
fsc->mount_options->server_path + 1 : "";

err = __ceph_open_session(fsc->client, started);
if (err < 0)
goto out;

p = path_remove_extra_slash(fsc->mount_options->server_path);
if (IS_ERR(p)) {
err = PTR_ERR(p);
goto out;
}
/* if the server path is omitted or just consists of '/' */
if (!p)
path = "";
else
path = p;
dout("mount opening path '%s'\n", path);

err = ceph_fs_debugfs_init(fsc);
if (err < 0)
goto out;

root = open_root_dentry(fsc, path, started);
kfree(p);
if (IS_ERR(root)) {
err = PTR_ERR(root);
goto out;
2 changes: 1 addition & 1 deletion fs/ceph/super.h
Original file line number Diff line number Diff line change
@@ -70,7 +70,7 @@ struct ceph_mount_options {

char *snapdir_name; /* default ".snap" */
char *mds_namespace; /* default NULL */
char *server_path; /* default "/" */
char *server_path; /* default NULL (means "/") */
};

struct ceph_fs_client {

0 comments on commit 1cccf9d

Please sign in to comment.