nbd: fix crash when the blksize is zero

This will allow the blksize to be set zero and then use 1024 as
default.

Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Xiubo Li <xiubli@redhat.com>
[fix to use goto out instead of return in genl_connect]
Signed-off-by: Mike Christie <mchristi@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 3a9bca3..5c4e3f2 100644 (file)
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -134,6 +134,8 @@ static struct dentry *nbd_dbg_dir;
 
 #define NBD_MAGIC 0x68797548
 
+#define NBD_DEF_BLKSIZE 1024
+
 static unsigned int nbds_max = 16;
 static int max_part = 16;
 static struct workqueue_struct *recv_workqueue;
@@ -1236,6 +1238,14 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
                nbd_config_put(nbd);
 }
 
+static bool nbd_is_valid_blksize(unsigned long blksize)
+{
+       if (!blksize || !is_power_of_2(blksize) || blksize < 512 ||
+           blksize > PAGE_SIZE)
+               return false;
+       return true;
+}
+
 /* Must be called with config_lock held */
 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                       unsigned int cmd, unsigned long arg)
@@ -1251,8 +1261,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
        case NBD_SET_SOCK:
                return nbd_add_socket(nbd, arg, false);
        case NBD_SET_BLKSIZE:
-               if (!arg || !is_power_of_2(arg) || arg < 512 ||
-                   arg > PAGE_SIZE)
+               if (!arg)
+                       arg = NBD_DEF_BLKSIZE;
+               if (!nbd_is_valid_blksize(arg))
                        return -EINVAL;
                nbd_size_set(nbd, arg,
                             div_s64(config->bytesize, arg));
@@ -1332,7 +1343,7 @@ static struct nbd_config *nbd_alloc_config(void)
        atomic_set(&config->recv_threads, 0);
        init_waitqueue_head(&config->recv_wq);
        init_waitqueue_head(&config->conn_wait);
-       config->blksize = 1024;
+       config->blksize = NBD_DEF_BLKSIZE;
        atomic_set(&config->live_connections, 0);
        try_module_get(THIS_MODULE);
        return config;
@@ -1768,6 +1779,12 @@ again:
        if (info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]) {
                u64 bsize =
                        nla_get_u64(info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]);
+               if (!bsize)
+                       bsize = NBD_DEF_BLKSIZE;
+               if (!nbd_is_valid_blksize(bsize)) {
+                       ret = -EINVAL;
+                       goto out;
+               }
                nbd_size_set(nbd, bsize, div64_u64(config->bytesize, bsize));
        }
        if (info->attrs[NBD_ATTR_TIMEOUT]) {