diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-07-24 13:22:41 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-07-24 13:22:41 -0700 |
| commit | dad0a87d79ff3e7e4ef35ebd588fe4f115329964 (patch) | |
| tree | b8f300e11060a7c917865a6ca80b74c12b7cc18b /drivers/block/rbd.c | |
| parent | 981f4a2baaf15a15fd4a22d311f15d066e28833b (diff) | |
| parent | 5b602344a49e039e792ce5a8923bcc61412ee134 (diff) | |
| download | linux-dad0a87d79ff3e7e4ef35ebd588fe4f115329964.tar.gz linux-dad0a87d79ff3e7e4ef35ebd588fe4f115329964.tar.bz2 linux-dad0a87d79ff3e7e4ef35ebd588fe4f115329964.zip | |
Merge tag 'ceph-for-7.2-rc5' of https://github.com/ceph/ceph-client
Pull ceph fixes from Ilya Dryomov:
"A bunch of assorted fixes with the majority being hardening against
malformed input and invalid data scenarios that don't happen in real
deployments but can be utilized to trigger use-after-free and similar
issues, some error path leak fixups and two patches from Max to avoid
a potential hang in __ceph_get_caps() and unintended nesting of
current->journal_info while handling replies from the MDS.
All marked for stable"
* tag 'ceph-for-7.2-rc5' of https://github.com/ceph/ceph-client:
ceph: avoid fs reclaim while using current->journal_info
ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
rbd: Reset positive result codes to zero in object map update path
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
libceph: refresh auth->authorizer_buf{,_len} after authorizer update
ceph: fix refcount leak in ceph_readdir()
libceph: guard missing CRUSH type name lookup
libceph: remove debugfs files before client teardown
libceph: bound get_version reply decode to front len
ceph: fix writeback_count leak in write_folio_nounlock()
libceph: fix two unsafe bare decodes in decode_lockers()
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
libceph: Reject monmaps advertising zero monitors
libceph: reject zero bucket types in crush_decode
libceph: Fix multiplication overflow in decode_new_up_state_weight()
Diffstat (limited to 'drivers/block/rbd.c')
| -rw-r--r-- | drivers/block/rbd.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c index ac90d81aa294..1f1c2810f6ee 100644 --- a/drivers/block/rbd.c +++ b/drivers/block/rbd.c @@ -1950,10 +1950,15 @@ static int rbd_object_map_update_finish(struct rbd_obj_request *obj_req, bool has_current_state; void *p; - if (osd_req->r_result) + if (osd_req->r_result < 0) return osd_req->r_result; /* + * Writes aren't allowed to return a data payload. + */ + WARN_ON_ONCE(osd_req->r_result > 0); + + /* * Nothing to do for a snapshot object map. */ if (osd_req->r_num_ops == 1) |