Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH] nbd: fix crash when the blksize is zero
To:     Mike Christie <mchristi@redhat.com>, josef@toxicpanda.com,
        axboe@kernel.dk, nbd@other.debian.org
Cc:     linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
        atumball@redhat.com
References: <20190527054438.13548-1-xiubli@redhat.com>
 <5CEED598.7080703@redhat.com>
From:   Xiubo Li <xiubli@redhat.com>
Message-ID: <3a7e1aed-c07a-8338-73a5-8389a2fe78dc@redhat.com>
Date:   Thu, 30 May 2019 09:28:07 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
 Thunderbird/60.7.0
MIME-Version: 1.0
In-Reply-To: <5CEED598.7080703@redhat.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 2019/5/30 2:55, Mike Christie wrote:
> On 05/27/2019 12:44 AM, xiubli@redhat.com wrote:
>> From: Xiubo Li <xiubli@redhat.com>
>>
>> This will allow the blksize to be set zero and then use 1024 as
>> default.
>>
>> Signed-off-by: Xiubo Li <xiubli@redhat.com>
>> ---
>>   drivers/block/nbd.c | 21 ++++++++++++++++++---
>>   1 file changed, 18 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
>> index 053958a..4c1de1c 100644
>> --- a/drivers/block/nbd.c
>> +++ b/drivers/block/nbd.c
>> @@ -135,6 +135,8 @@ struct nbd_cmd {
>>   
>>   #define NBD_MAGIC 0x68797548
>>   
>> +#define NBD_DEF_BLKSIZE 1024
>> +
>>   static unsigned int nbds_max = 16;
>>   static int max_part = 16;
>>   static struct workqueue_struct *recv_workqueue;
>> @@ -1237,6 +1239,14 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
>>   		nbd_config_put(nbd);
>>   }
>>   
>> +static bool nbd_is_valid_blksize(unsigned long blksize)
>> +{
>> +	if (!blksize || !is_power_of_2(blksize) || blksize < 512 ||
>> +		blksize > PAGE_SIZE)
>> +		return false;
>> +	return true;
>> +}
>> +
>>   /* Must be called with config_lock held */
>>   static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
>>   		       unsigned int cmd, unsigned long arg)
>> @@ -1252,8 +1262,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
>>   	case NBD_SET_SOCK:
>>   		return nbd_add_socket(nbd, arg, false);
>>   	case NBD_SET_BLKSIZE:
>> -		if (!arg || !is_power_of_2(arg) || arg < 512 ||
>> -		    arg > PAGE_SIZE)
>> +		if (!arg)
>> +			arg = NBD_DEF_BLKSIZE;
>> +		if (!nbd_is_valid_blksize(arg))
>>   			return -EINVAL;
>>   		nbd_size_set(nbd, arg,
>>   			     div_s64(config->bytesize, arg));
>> @@ -1333,7 +1344,7 @@ static struct nbd_config *nbd_alloc_config(void)
>>   	atomic_set(&config->recv_threads, 0);
>>   	init_waitqueue_head(&config->recv_wq);
>>   	init_waitqueue_head(&config->conn_wait);
>> -	config->blksize = 1024;
>> +	config->blksize = NBD_DEF_BLKSIZE;
>>   	atomic_set(&config->live_connections, 0);
>>   	try_module_get(THIS_MODULE);
>>   	return config;
>> @@ -1769,6 +1780,10 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
>>   	if (info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]) {
>>   		u64 bsize =
>>   			nla_get_u64(info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]);
>> +		if (!bsize)
>> +			bsize = NBD_DEF_BLKSIZE;
>> +		if (!nbd_is_valid_blksize(bsize))
>> +			return -EINVAL;
> You can't only return here. You need to also drop the mutex, do
> nbd_put, and drop config_refs reference.
>
> Maybe you want to move this check to the beginning of the function with
> the NBD_ATTR_SIZE_BYTES sanity check since the error handling is easier
> there.

Yeah, right.

I saw your resend patch of this and that looks good to me.

Thanks
BRs
Xiubo


>
>>   		nbd_size_set(nbd, bsize, div64_u64(config->bytesize, bsize));
>>   	}
>>   	if (info->attrs[NBD_ATTR_TIMEOUT]) {
>>