From: Xiubo Li <xiubli@redhat.com>

Date: Thu, 18 May 2023 09:47:23 +0800

Subject: ceph: force updating the msg pointer in non-split case

Git-commit: 4cafd0400bcb6187c0d4ab4d4b0229a89ac4f8c2

Patch-mainline: v6.4-rc3

References: bsc#1211804

When the MClientSnap reqeust's op is not CEPH_SNAP_OP_SPLIT the

request may still contain a list of 'split_realms', and we need

to skip it anyway. Or it will be parsed as a corrupt snaptrace.

Cc: stable@vger.kernel.org

Link: https://tracker.ceph.com/issues/61200

Reported-by: Frank Schilder <frans@dtu.dk>

Signed-off-by: Xiubo Li <xiubli@redhat.com>

Reviewed-by: Ilya Dryomov <idryomov@gmail.com>

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

Acked-by: Luís Henriques <lhenriques@suse.de>

---

 fs/ceph/snap.c | 13 +++++++++++++

 1 file changed, 13 insertions(+)

diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c

index 87007203f130..0b236ebd989f 100644

--- a/fs/ceph/snap.c

+++ b/fs/ceph/snap.c

@@ -1111,6 +1111,19 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,

 				continue;

 			adjust_snap_realm_parent(mdsc, child, realm->ino);

 		}

+	} else {

+		/*

+		 * In the non-split case both 'num_split_inos' and

+		 * 'num_split_realms' should be 0, making this a no-op.

+		 * However the MDS happens to populate 'split_realms' list

+		 * in one of the UPDATE op cases by mistake.

+		 *

+		 * Skip both lists just in case to ensure that 'p' is

+		 * positioned at the start of realm info, as expected by

+		 * ceph_update_snap_trace().

+		 */

+		p += sizeof(u64) * num_split_inos;

+		p += sizeof(u64) * num_split_realms;

 	}

 	/*