Hide Forgot
quota in its write call does, 1. gets stat of the file. 2. continues with write if quota is not exceeded. between 1 and 2, the arguments are stored in a structure stored in frame->local. While doing so, the pointer to vector is stored instead of copying the entire vector structure. This results in accessing invalid memory during 2, hence causing invalid iov_base and iov_len. Due to this transport may not transfer the buffer, since iov_len may be arbitrarily high.
PATCH: http://patches.gluster.com/patch/2818 in master (features/quota: store the entire vector in local instead of just a pointer to it in writev.)
PATCH: http://patches.gluster.com/patch/2855 in master (features/quota: Remember '/' loc_t to initiate xattr calls.)
PATCH: http://patches.gluster.com/patch/2819 in release-2.0 (features/quota: store the entire vector in local instead of just a pointer to it in writev.)
PATCH: http://patches.gluster.com/patch/2857 in release-3.0 (features/quota: Remember '/' loc_t to initiate xattr calls.)
PATCH: http://patches.gluster.com/patch/2818 in release-3.0 (features/quota: store the entire vector in local instead of just a pointer to it in writev.)