<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux/fs/ceph/export.c, branch v3.4.19</title>
<subtitle>Linux kernel source tree</subtitle>
<id>https://git.amat.us/linux/atom/fs/ceph/export.c?h=v3.4.19</id>
<link rel='self' href='https://git.amat.us/linux/atom/fs/ceph/export.c?h=v3.4.19'/>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/'/>
<updated>2012-10-21T16:27:57Z</updated>
<entry>
<title>tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking</title>
<updated>2012-10-21T16:27:57Z</updated>
<author>
<name>Hugh Dickins</name>
<email>hughd@google.com</email>
</author>
<published>2012-10-08T03:32:51Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=530258fceacd8c17075906c648c1ba20928c940b'/>
<id>urn:sha1:530258fceacd8c17075906c648c1ba20928c940b</id>
<content type='text'>
commit 35c2a7f4908d404c9124c2efc6ada4640ca4d5d5 upstream.

Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
	u64 inum = fid-&gt;raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():

BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [&lt;ffffffff812190d0&gt;] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
 [&lt;ffffffff81488649&gt;] ? exportfs_decode_fh+0x79/0x2d0
 [&lt;ffffffff812d77c3&gt;] do_handle_open+0x163/0x2c0
 [&lt;ffffffff812d792c&gt;] sys_open_by_handle_at+0xc/0x10
 [&lt;ffffffff83a5f3f8&gt;] tracesys+0xe1/0xe6

Right, tmpfs is being stupid to access fid-&gt;raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.

But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.

Reported-by: Sasha Levin &lt;levinsasha928@gmail.com&gt;
Signed-off-by: Hugh Dickins &lt;hughd@google.com&gt;
Cc: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Cc: Sage Weil &lt;sage@inktank.com&gt;
Cc: Steven Whitehouse &lt;swhiteho@redhat.com&gt;
Cc: Christoph Hellwig &lt;hch@infradead.org&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
</entry>
<entry>
<title>ceph: avoid useless dget/dput in encode_fh</title>
<updated>2012-01-10T16:57:00Z</updated>
<author>
<name>Sage Weil</name>
<email>sage@newdream.net</email>
</author>
<published>2012-01-03T16:20:40Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=ee6b1baf67591b6d7ce1a6a07544343433d5ec9e'/>
<id>urn:sha1:ee6b1baf67591b6d7ce1a6a07544343433d5ec9e</id>
<content type='text'>
Nothing we do here sleeps, so just do it under d_lock and avoid the dget/
dput entirely.

Reported-by: Al Viro &lt;viro@ZenIV.linux.org.uk&gt;
Signed-off-by: Sage Weil &lt;sage@newdream.net&gt;
</content>
</entry>
<entry>
<title>ceph: avoid d_parent in ceph_dentry_hash; fix ceph_encode_fh() hashing bug</title>
<updated>2011-07-26T18:30:55Z</updated>
<author>
<name>Sage Weil</name>
<email>sage@newdream.net</email>
</author>
<published>2011-07-26T18:30:55Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=e5f86dc377e7ff2b4195831153a85a3e76fefff2'/>
<id>urn:sha1:e5f86dc377e7ff2b4195831153a85a3e76fefff2</id>
<content type='text'>
Have caller pass in a safely-obtained reference to the parent directory
for calculating a dentry's hash valud.

While we're here, simpify the flow through ceph_encode_fh() so that there
is a single exit point and cleanup.

Also fix a bug with the dentry hash calculation: calculate the hash for the
dentry we were given, not its parent.

Reviewed-by: Yehuda Sadeh &lt;yehuda@hq.newdream.net&gt;
Signed-off-by: Sage Weil &lt;sage@newdream.net&gt;
</content>
</entry>
<entry>
<title>ceph: use ihold when we already have an inode ref</title>
<updated>2011-06-08T04:34:11Z</updated>
<author>
<name>Sage Weil</name>
<email>sage@newdream.net</email>
</author>
<published>2011-05-27T16:24:26Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=70b666c3b4cb2b96098d80e6f515e4bc6d37db5a'/>
<id>urn:sha1:70b666c3b4cb2b96098d80e6f515e4bc6d37db5a</id>
<content type='text'>
We should use ihold whenever we already have a stable inode ref, even
when we aren't holding i_lock.  This avoids adding new and unnecessary
locking dependencies.

Signed-off-by: Sage Weil &lt;sage@newdream.net&gt;
</content>
</entry>
<entry>
<title>ceph: avoid inode lookup on nfs fh reconnect</title>
<updated>2011-05-24T18:52:06Z</updated>
<author>
<name>Sage Weil</name>
<email>sage@newdream.net</email>
</author>
<published>2011-04-06T16:35:00Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=45e3d3eeb6578e523e100622266945ecd71723bb'/>
<id>urn:sha1:45e3d3eeb6578e523e100622266945ecd71723bb</id>
<content type='text'>
If we get the inode from the MDS, we have a reference in req; don't do a
fresh lookup.

Signed-off-by: Sage Weil &lt;sage@newdream.net&gt;
</content>
</entry>
<entry>
<title>ceph: use LOOKUPINO to make unconnected nfs fh more reliable</title>
<updated>2011-05-24T18:52:05Z</updated>
<author>
<name>Sage Weil</name>
<email>sage@newdream.net</email>
</author>
<published>2011-04-06T16:31:40Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=3c454cf21645bc96668e286f6352ac2c4c895fa2'/>
<id>urn:sha1:3c454cf21645bc96668e286f6352ac2c4c895fa2</id>
<content type='text'>
If we are unable to locate an inode by ino, ask the MDS using the new
LOOKUPINO command.

Signed-off-by: Sage Weil &lt;sage@newdream.net&gt;
</content>
</entry>
<entry>
<title>ceph: add dir_layout to inode</title>
<updated>2011-01-12T23:15:12Z</updated>
<author>
<name>Sage Weil</name>
<email>sage@newdream.net</email>
</author>
<published>2010-11-16T19:14:34Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=6c0f3af72cb1622a66962a1180c36ef8c41be8e2'/>
<id>urn:sha1:6c0f3af72cb1622a66962a1180c36ef8c41be8e2</id>
<content type='text'>
Add a ceph_dir_layout to the inode, and calculate dentry hash values based
on the parent directory's specified dir_hash function.  This is needed
because the old default Linux dcache hash function is extremely week and
leads to a poor distribution of files among dir fragments.

Signed-off-by: Sage Weil &lt;sage@newdream.net&gt;
</content>
</entry>
<entry>
<title>ceph: factor out libceph from Ceph file system</title>
<updated>2010-10-20T22:37:28Z</updated>
<author>
<name>Yehuda Sadeh</name>
<email>yehuda@hq.newdream.net</email>
</author>
<published>2010-04-06T22:14:15Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=3d14c5d2b6e15c21d8e5467dc62d33127c23a644'/>
<id>urn:sha1:3d14c5d2b6e15c21d8e5467dc62d33127c23a644</id>
<content type='text'>
This factors out protocol and low-level storage parts of ceph into a
separate libceph module living in net/ceph and include/linux/ceph.  This
is mostly a matter of moving files around.  However, a few key pieces
of the interface change as well:

 - ceph_client becomes ceph_fs_client and ceph_client, where the latter
   captures the mon and osd clients, and the fs_client gets the mds client
   and file system specific pieces.
 - Mount option parsing and debugfs setup is correspondingly broken into
   two pieces.
 - The mon client gets a generic handler callback for otherwise unknown
   messages (mds map, in this case).
 - The basic supported/required feature bits can be expanded (and are by
   ceph_fs_client).

No functional change, aside from some subtle error handling cases that got
cleaned up in the refactoring process.

Signed-off-by: Sage Weil &lt;sage@newdream.net&gt;
</content>
</entry>
<entry>
<title>ceph: Update max_len with minimum required size</title>
<updated>2010-10-07T15:00:24Z</updated>
<author>
<name>Aneesh Kumar K.V</name>
<email>aneesh.kumar@linux.vnet.ibm.com</email>
</author>
<published>2010-10-05T10:33:42Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=bba0cd0e3d97472855840af817b766e3f632a501'/>
<id>urn:sha1:bba0cd0e3d97472855840af817b766e3f632a501</id>
<content type='text'>
encode_fh on error should update max_len with minimum required
size, so that caller can redo the call with the reallocated buffer.
This is required with open by handle patch series

Signed-off-by: Aneesh Kumar K.V &lt;aneesh.kumar@linux.vnet.ibm.com&gt;
Signed-off-by: Sage Weil &lt;sage@newdream.net&gt;
</content>
</entry>
<entry>
<title>ceph: Fix return value of encode_fh function</title>
<updated>2010-10-07T15:00:23Z</updated>
<author>
<name>Aneesh Kumar K.V</name>
<email>aneesh.kumar@linux.vnet.ibm.com</email>
</author>
<published>2010-10-05T10:33:41Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=92923dcbfcad107b0e0469f579a2455729ccf10e'/>
<id>urn:sha1:92923dcbfcad107b0e0469f579a2455729ccf10e</id>
<content type='text'>
encode_fh function should return 255 on error as done by other file
system to indicate EOVERFLOW. Also max_len is in sizeof(u32) units
and not in bytes.

Signed-off-by: Aneesh Kumar K.V &lt;aneesh.kumar@linux.vnet.ibm.com&gt;
Signed-off-by: Sage Weil &lt;sage@newdream.net&gt;
</content>
</entry>
</feed>
