Commit 708c8716 authored by Dan Carpenter's avatar Dan Carpenter Committed by Ilya Dryomov
Browse files

ceph: fix off by one bugs in unsafe_request_wait() 



The "> max" tests should be ">= max" to prevent an out of bounds access
on the next lines.

Fixes: e1a4541e ("ceph: flush the mdlog before waiting on unsafe reqs")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarIlya Dryomov <idryomov@gmail.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent e4e737bb

fs/ceph/caps.c

+2 −2
Original line number Diff line number Diff line
@@ -2263,7 +2263,7 @@ static int unsafe_request_wait(struct inode *inode) 
			list_for_each_entry(req, &ci->i_unsafe_dirops,

					    r_unsafe_dir_item) {

				s = req->r_session;

				if (unlikely(s->s_mds > max)) {

				if (unlikely(s->s_mds >= max)) {

					spin_unlock(&ci->i_unsafe_lock);

					goto retry;

				}
@@ -2277,7 +2277,7 @@ static int unsafe_request_wait(struct inode *inode) 
			list_for_each_entry(req, &ci->i_unsafe_iops,

					    r_unsafe_target_item) {

				s = req->r_session;

				if (unlikely(s->s_mds > max)) {

				if (unlikely(s->s_mds >= max)) {

					spin_unlock(&ci->i_unsafe_lock);

					goto retry;

				}