From e165d89f7f54ac577687dfed38f2a9e7537738e3 Mon Sep 17 00:00:00 2001 From: Zach Brown Date: Mon, 11 Sep 2017 19:18:49 -0700 Subject: [PATCH] scoutfs: warn on invalid item counts We had a bug where a caller was slowly increasing their item count for every transaction they attempted in a loop. Eventually the item count grew to be too large to fit in a segment and they slept indefinitely. Let's warn on invalid and impossibly large item counts as we enter transactions. Signed-off-by: Zach Brown --- kmod/src/trans.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kmod/src/trans.c b/kmod/src/trans.c index d00d36c0..c5a9189f 100644 --- a/kmod/src/trans.c +++ b/kmod/src/trans.c @@ -346,6 +346,15 @@ int scoutfs_hold_trans(struct super_block *sb, struct scoutfs_item_count *cnt) struct scoutfs_reservation *rsv; int ret; + /* + * Caller shouldn't provide garbage counts, nor counts that + * can't fit in segments by themselves. + */ + if (WARN_ON_ONCE(cnt->items <= 0 || cnt->keys < 0 || cnt->vals < 0) || + WARN_ON_ONCE(!scoutfs_seg_fits_single(cnt->items, cnt->keys, + cnt->vals))) + return -EINVAL; + if (current == sbi->trans_task) return 0;