ceph: correct subscribe_ack msgpool payload size

Defined a struct for the SUBSCRIBE_ACK, and use that to size
the msgpool.

Signed-off-by: Sage Weil <sage@newdream.net>

diff --git a/fs/ceph/ceph_fs.h b/fs/ceph/ceph_fs.h
index 56af192cb430d448b211647f791025312bb3fe62..9b16e2e06ea6cdcf1eadbf4beefb5e16d6d4fd9a 100644 (file)
--- a/fs/ceph/ceph_fs.h
+++ b/fs/ceph/ceph_fs.h
@@ -162,6 +162,11 @@ struct ceph_mon_subscribe_item {
        __u8 onetime;
 } __attribute__ ((packed));
 
+struct ceph_mon_subscribe_ack {
+       __le32 duration;         /* seconds */
+       struct ceph_fsid fsid;
+} __attribute__ ((packed));
+
 /*
  * mds states
  *   > 0 -> in

diff --git a/fs/ceph/mon_client.c b/fs/ceph/mon_client.c
index bea2be9077e4a8f82669212be00ba0e630744463..d52e52968d01bbd69554909e961289a5a19f37d5 100644 (file)
--- a/fs/ceph/mon_client.c
+++ b/fs/ceph/mon_client.c
@@ -199,10 +199,12 @@ static void handle_subscribe_ack(struct ceph_mon_client *monc,
                                 struct ceph_msg *msg)
 {
        unsigned seconds;
-       void *p = msg->front.iov_base;
-       void *end = p + msg->front.iov_len;
+       struct ceph_mon_subscribe_ack *h = msg->front.iov_base;
+
+       if (msg->front.iov_len < sizeof(*h))
+               goto bad;
+       seconds = le32_to_cpu(h->duration);
 
-       ceph_decode_32_safe(&p, end, seconds, bad);
        mutex_lock(&monc->mutex);
        if (monc->hunting) {
                pr_info("mon%d %s session established\n",
@@ -541,7 +543,8 @@ int ceph_monc_init(struct ceph_mon_client *monc, struct ceph_client *cl)
        err = ceph_msgpool_init(&monc->msgpool_mount_ack, 4096, 1, false);
        if (err < 0)
                goto out;
-       err = ceph_msgpool_init(&monc->msgpool_subscribe_ack, 8, 1, false);
+       err = ceph_msgpool_init(&monc->msgpool_subscribe_ack,
+                              sizeof(struct ceph_mon_subscribe_ack), 1, false);
        if (err < 0)
                goto out;
        err = ceph_msgpool_init(&monc->msgpool_statfs_reply,