Commit 5e82a0f5 authored by Artur Paszkiewicz's avatar Artur Paszkiewicz Committed by Jim Harris
Browse files

raid: validate base bdev slot number when parsing superblock 



Signed-off-by: default avatarArtur Paszkiewicz <artur.paszkiewicz@intel.com>
Change-Id: Ic2f9f6dd3367f7b0a15715e401937daa43c00796
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/22488


Reviewed-by: default avatarKonrad Sztyber <konrad.sztyber@intel.com>
Community-CI: Mellanox Build Bot
Reviewed-by: default avatarJim Harris <jim.harris@samsung.com>
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
parent e9af23de

module/bdev/raid/bdev_raid_sb.c

+11 −0
Original line number Diff line number Diff line
@@ -137,6 +137,8 @@ raid_bdev_parse_superblock(struct raid_bdev_read_sb_ctx *ctx) 
{

	struct raid_bdev_superblock *sb = ctx->buf;

	struct spdk_bdev *bdev = spdk_bdev_desc_get_bdev(ctx->desc);

	struct raid_bdev_sb_base_bdev *sb_base_bdev;

	uint8_t i;



	if (memcmp(sb->signature, RAID_BDEV_SB_SIG, sizeof(sb->signature))) {

		SPDK_DEBUGLOG(bdev_raid_sb, "invalid signature\n");
@@ -170,6 +172,15 @@ raid_bdev_parse_superblock(struct raid_bdev_read_sb_ctx *ctx) 
			     sb->version.minor, spdk_bdev_get_name(bdev), RAID_BDEV_SB_VERSION_MINOR);

	}



	for (i = 0; i < sb->base_bdevs_size; i++) {

		sb_base_bdev = &sb->base_bdevs[i];

		if (sb_base_bdev->slot >= sb->num_base_bdevs) {

			SPDK_WARNLOG("Invalid superblock base bdev slot number %u on bdev %s\n",

				     sb_base_bdev->slot, spdk_bdev_get_name(bdev));

			return -EINVAL;

		}

	}



	return 0;

}

test/unit/lib/bdev/raid/bdev_raid_sb.c/bdev_raid_sb_ut.c

+6 −0
Original line number Diff line number Diff line
@@ -369,6 +369,12 @@ test_raid_bdev_parse_superblock(void) 
	CU_ASSERT(raid_bdev_parse_superblock(&ctx) == -EAGAIN);

	ctx.buf_size = g_bdev.blocklen * 3;

	CU_ASSERT(raid_bdev_parse_superblock(&ctx) == 0);



	/* invalid base bdev slot number */

	prepare_sb(sb);

	sb->base_bdevs[0].slot = sb->num_base_bdevs = sb->base_bdevs_size = 2;

	raid_bdev_sb_update_crc(sb);

	CU_ASSERT(raid_bdev_parse_superblock(&ctx) == -EINVAL);

}



int