libceph: don't access invalid memory in keepalive2 path

This

    struct ceph_timespec ceph_ts;
    ...
    con_out_kvec_add(con, sizeof(ceph_ts), &ceph_ts);

wraps ceph_ts into a kvec and adds it to con->out_kvec array, yet
ceph_ts becomes invalid on return from prepare_write_keepalive().  As
a result, we send out bogus keepalive2 stamps.  Fix this by encoding
into a ceph_timespec member, similar to how acks are read and written.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Yan, Zheng <zyan@redhat.com>

1 files changed, 5 insertions, 4 deletions

diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 525f454f7531..b9b0e3b5da49 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -1353,11 +1353,12 @@ static void prepare_write_keepalive(struct ceph_connection *con)
         dout("prepare_write_keepalive %p\n", con);
         con_out_kvec_reset(con);
         if (con->peer_features & CEPH_FEATURE_MSGR_KEEPALIVE2) {
-                struct timespec ts = CURRENT_TIME;
-                struct ceph_timespec ceph_ts;
-                ceph_encode_timespec(&ceph_ts, &ts);
+                struct timespec now = CURRENT_TIME;
+
                 con_out_kvec_add(con, sizeof(tag_keepalive2), &tag_keepalive2);
-                con_out_kvec_add(con, sizeof(ceph_ts), &ceph_ts);
+                ceph_encode_timespec(&con->out_temp_keepalive2, &now);
+                con_out_kvec_add(con, sizeof(con->out_temp_keepalive2),
+                                 &con->out_temp_keepalive2);
         } else {
                 con_out_kvec_add(con, sizeof(tag_keepalive), &tag_keepalive);
         }