Commit b1278814 authored by Yalong Wang's avatar Yalong Wang Committed by Jim Harris
Browse files

lib/blob: fix active.clusters array out-of-bounds access 



Change-Id: I1b3c1cd9f5c35ea31900db4ebfbc164c68457176
Signed-off-by: default avatarYalong Wang <yalong9@staff.sina.com.cn>
Reviewed-on: https://review.spdk.io/c/spdk/spdk/+/25732


Reviewed-by: default avatarTomasz Zawadzki <tomasz@tzawadzki.com>
Tested-by: default avatarSPDK Automated Test System <spdkbot@gmail.com>
Community-CI: Mellanox Build Bot
Reviewed-by: default avatarGangCao <gang.cao@intel.com>
Reviewed-by: default avatarMateusz Kozlowski <mateusz.kozlowski@solidigm.com>
parent 93939df4

lib/blob/blobstore.c

+3 −0
Original line number Diff line number Diff line
@@ -9026,6 +9026,9 @@ blob_free_cluster_msg(void *arg) 


	start_cluster_idx = (ctx->cluster_num / SPDK_EXTENTS_PER_EP) * SPDK_EXTENTS_PER_EP;

	for (i = 0; i < SPDK_EXTENTS_PER_EP; ++i) {

		if (spdk_unlikely(start_cluster_idx + i >= ctx->blob->active.num_clusters)) {

			break;

		}

		if (ctx->blob->active.clusters[start_cluster_idx + i] != 0) {

			free_extent_page = false;

			break;

test/unit/lib/blob/blob.c/blob_ut.c

+14 −0
Original line number Diff line number Diff line
@@ -4814,6 +4814,20 @@ blob_thin_prov_unmap_cluster(void) 
	CU_ASSERT(free_clusters == spdk_bs_free_cluster_count(bs));

	CU_ASSERT(blob->active.num_clusters == CLUSTER_COUNT);



	/* Triggers a potential out-of-bounds access on blob->active.clusters,

	 * when checking whether a extPage could be freed */

	g_bserrno = -1;

	spdk_blob_io_write(blob, ch, payload_write, 0, 1, blob_op_complete, NULL);

	poll_threads();

	CU_ASSERT(g_bserrno == 0);

	CU_ASSERT(CLUSTER_COUNT - 1 == spdk_bs_free_cluster_count(bs));



	g_bserrno = -1;

	spdk_blob_io_unmap(blob, ch, 0, io_units_per_cluster, blob_op_complete, NULL);

	poll_threads();

	CU_ASSERT(g_bserrno == 0);

	CU_ASSERT(CLUSTER_COUNT == spdk_bs_free_cluster_count(bs));



	/* Fill all clusters */

	for (i = 0; i < CLUSTER_COUNT; i++) {

		memset(payload_write, i + 1, sizeof(payload_write));