diff --git a/0008-Fix-unsigned-type-size_t.patch b/0008-Fix-unsigned-type-size_t.patch new file mode 100644 index 0000000000000000000000000000000000000000..efa54f1061fa89947027c0ecdcb2be2292c6937c --- /dev/null +++ b/0008-Fix-unsigned-type-size_t.patch @@ -0,0 +1,108 @@ +From 15e6d578d05946fff38ce1939c366ca8f478451b Mon Sep 17 00:00:00 2001 +From: Thales Antunes de Oliveira Barretto +Date: Mon, 10 Feb 2025 01:04:54 -0300 +Subject: [PATCH] Fix unsigned type "size_t" (#4470) + +This commit address the wrong use of "size_t" instead of "ssize_t". + + The functions that run xattr, like sys_lgetxattr(), sys_lgetxattr() +return negative values on error, that is, they return -1. But some of its users +were found capture this return in an unsigned "size_t" (implict type conversion). + + This commit touches the posix xlator files posix-helpers.c and +posix-metadata.c, but also the tests get-mdata-xattr.c + + In posix-helpers.c were found posix_cs_set_state, posix_cs_heal_state +and posix_cs_check_status the offending "size_t" in place of "ssize_t" for +the variable "xattrsize". + + In posix-metadata.c was found posix_fetch_mdata_xattr and the +variable "size" using an unsigned "size_t" in the exact same way.. + + In get-mdata-xattr.c, the posix_fetch_mdata_xattr incurs in the +exact same offense with the variable "size". + + This commit changes these cases to the signed "ssize_t". + +Examples: + +always true case + + if (fd) { + xattrsize = sys_fgetxattr(*fd, GF_CS_OBJECT_REMOTE, NULL, 0); + if (xattrsize != -1) { + +always false case + + xattrsize = sys_fgetxattr(*fd, GF_CS_OBJECT_REMOTE, value, + xattrsize + 1); + if (xattrsize == -1) { + if (value) + GF_FREE(value); + +Signed-off-by: Thales Antunes de Oliveira Barretto +--- + tests/utils/get-mdata-xattr.c | 2 +- + xlators/storage/posix/src/posix-helpers.c | 6 +++--- + xlators/storage/posix/src/posix-metadata.c | 2 +- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/tests/utils/get-mdata-xattr.c b/tests/utils/get-mdata-xattr.c +index 9911b9b..224b772 100644 +--- a/tests/utils/get-mdata-xattr.c ++++ b/tests/utils/get-mdata-xattr.c +@@ -73,7 +73,7 @@ posix_mdata_from_disk(posix_mdata_t *out, posix_mdata_disk_t *in) + static int + posix_fetch_mdata_xattr(const char *real_path, posix_mdata_t *metadata) + { +- size_t size = -1; ++ ssize_t size = -1; + char *value = NULL; + char gfid_str[64] = {0}; + +diff --git a/xlators/storage/posix/src/posix-helpers.c b/xlators/storage/posix/src/posix-helpers.c +index df3ed73..045b295 100644 +--- a/xlators/storage/posix/src/posix-helpers.c ++++ b/xlators/storage/posix/src/posix-helpers.c +@@ -2997,7 +2997,7 @@ posix_cs_heal_state(xlator_t *this, const char *realpath, int *fd, + gf_boolean_t downloading = _gf_false; + int ret = 0; + gf_cs_obj_state state = GF_CS_ERROR; +- size_t xattrsize = 0; ++ ssize_t xattrsize = 0; + + if (!buf) { + ret = -1; +@@ -3147,7 +3147,7 @@ posix_cs_check_status(xlator_t *this, const char *realpath, int *fd, + gf_boolean_t downloading = _gf_false; + int ret = 0; + gf_cs_obj_state state = GF_CS_LOCAL; +- size_t xattrsize = 0; ++ ssize_t xattrsize = 0; + int op_errno = 0; + + if (fd) { +@@ -3248,7 +3248,7 @@ posix_cs_set_state(xlator_t *this, dict_t **rsp, gf_cs_obj_state state, + { + int ret = 0; + char *value = NULL; +- size_t xattrsize = 0; ++ ssize_t xattrsize = 0; + + if (!rsp) { + ret = -1; +diff --git a/xlators/storage/posix/src/posix-metadata.c b/xlators/storage/posix/src/posix-metadata.c +index aba8d5a..f274980 100644 +--- a/xlators/storage/posix/src/posix-metadata.c ++++ b/xlators/storage/posix/src/posix-metadata.c +@@ -73,7 +73,7 @@ static int + posix_fetch_mdata_xattr(xlator_t *this, const char *real_path_arg, int _fd, + inode_t *inode, posix_mdata_t *metadata, int *op_errno) + { +- size_t size = 256; ++ ssize_t size = 256; + int op_ret = -1; + char *value = NULL; + gf_boolean_t fd_based_fop = _gf_false; +-- +2.33.0 diff --git a/glusterfs.spec b/glusterfs.spec index 87a9a6bee2fa7d0b7a8791e57a53cdcc56cad2d0..53c594627056e290f91d5bee1ba8aaa048782d12 100644 --- a/glusterfs.spec +++ b/glusterfs.spec @@ -224,7 +224,7 @@ Summary: Distributed File System Name: glusterfs Version: 11.1 -Release: 7 +Release: 8 License: GPLv3 or GPLv2+ or LGPLv3+ URL: http://docs.gluster.org/ %if ( 0%{_for_fedora_koji_builds} ) @@ -244,6 +244,7 @@ Patch4: 0004-prevent-gnfs-IO-Errors-on-smaller-files.patch Patch5: 0005-glusterd-fix-memory-leaks-due-to-lack-of-GF_FREE.patch Patch6: 0006-glusterd-fix-memory-leaks-detected-by-asan.patch Patch7: 0007-fix-use-after-free-in-readdir.patch +Patch8: 0008-Fix-unsigned-type-size_t.patch BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX) BuildRequires: rpcgen gperftools-devel libunwind-devel @@ -1506,6 +1507,9 @@ exit 0 %{_mandir}/man8/*gluster*.8* %changelog +* Fri Oct 31 2025 xuchenchen - 11.1-8 +- Fix unsigned type "size_t" + * Fri Oct 24 2025 zhangyaqi - 11.1-7 - api/glfs: Fix use after free in readdir