RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-02-20 17:37:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge PR #32823 into master

Browse Source 
* refs/pull/32823/head:
	common/bl: fix memory corruption in bufferlist::claim_append()

Reviewed-by: Sage Weil <sage@redhat.com>
Reviewed-by: Kefu Chai <kchai@redhat.com>
This commit is contained in:
Sage Weil 2020-01-29 07:24:02 -06:00
commit 115148e126
2 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/common/buffer.cc
View File

@ -1309,7 +1309,8 @@ static ceph::spinlock debug_lock;
if (unlikely(raw && !raw->is_shareable())) {
auto* clone = ptr_node::copy_hypercombined(*curbuf);
curbuf = bl._buffers.erase_after_and_dispose(curbuf_prev);
bl._buffers.insert_after(curbuf_prev++, *clone);
bl._buffers.insert_after(curbuf_prev, *clone);
++curbuf_prev;
} else {
curbuf_prev = curbuf++;
}

22
src/test/bufferlist.cc
View File

@ -2900,6 +2900,28 @@ TEST(BufferList, DanglingLastP) {
EXPECT_EQ(0, ::memcmp("12C", bl.c_str(), 3));
}
TEST(BufferList, ClaimingTwoUnsharablePtrs) {
// two or more consecutive, to be precise. Otherwise the problem
// is nonexistent or self-healing.
// See: https://tracker.ceph.com/issues/43814.
bufferlist to_claim;
{
bufferptr one(buffer::create_unshareable(3));
one.copy_in(0, 3, "ABC");
to_claim.push_back(std::move(one));
bufferptr two(buffer::create_unshareable(3));
two.copy_in(0, 3, "123");
to_claim.push_back(std::move(two));
}
bufferlist claimer;
// this is supposed to not fail because of destructing wrong bptr:
// [ RUN ] BufferList.ClaimingTwoUnsharablePtrs
// *** Error in `./bin/unittest_bufferlist': free(): invalid pointer: 0x00007ffe20f03e20 ***
claimer.claim_append(to_claim);
EXPECT_EQ(0, ::memcmp("ABC123", claimer.c_str(), 6));
}
TEST(BufferHash, all) {
{
bufferlist bl;