Skip to content

Commit a81bd2d

Browse files
committed
pybind/rbd: don't produce info on errors in aio_mirror_image_get_info()
Check completion return value before attemting to decode c_info. Otherwise we are guaranteed to access invalid memory in decode_cstr() while trying to compute global_id string length when the client is blocklisted for example. Fixes: https://tracker.ceph.com/issues/63028 Signed-off-by: Ilya Dryomov <[email protected]>
1 parent 9b8e8d9 commit a81bd2d

File tree

1 file changed

+12
-7
lines changed

1 file changed

+12
-7
lines changed

src/pybind/rbd/rbd.pyx

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4511,13 +4511,18 @@ written." % (self.name, ret, length))
45114511
def oncomplete_(completion_v):
45124512
cdef:
45134513
Completion _completion_v = completion_v
4514-
rbd_mirror_image_info_t *c_info = <rbd_mirror_image_info_t *>_completion_v.buf
4515-
info = {
4516-
'global_id' : decode_cstr(c_info[0].global_id),
4517-
'state' : int(c_info[0].state),
4518-
'primary' : c_info[0].primary,
4519-
}
4520-
rbd_mirror_image_get_info_cleanup(c_info)
4514+
rbd_mirror_image_info_t *c_info
4515+
return_value = _completion_v.get_return_value()
4516+
if return_value == 0:
4517+
c_info = <rbd_mirror_image_info_t *>_completion_v.buf
4518+
info = {
4519+
'global_id' : decode_cstr(c_info[0].global_id),
4520+
'state' : int(c_info[0].state),
4521+
'primary' : c_info[0].primary,
4522+
}
4523+
rbd_mirror_image_get_info_cleanup(c_info)
4524+
else:
4525+
info = None
45214526
return oncomplete(_completion_v, info)
45224527

45234528
completion = self.__get_completion(oncomplete_)

0 commit comments

Comments
 (0)