lkml.org 
[lkml]   [2010]   [Dec]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] Ceph: Fix a use-after-free bug in ceph_destroy_client().
Hello,

In net/ceph/ceph_common.c::ceph_destroy_client() the pointer 'client' is
freed by kfree() and subsequently used in a call to dout() - use after
free bug.
Easily fixed by simply moving the kfree() call after the dout() call.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
---
ceph_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index f3e4a13..890bbbf 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -408,8 +408,8 @@ void ceph_destroy_client(struct ceph_client *client)

ceph_destroy_options(client->options);

- kfree(client);
dout("destroy_client %p done\n", client);
+ kfree(client);
}
EXPORT_SYMBOL(ceph_destroy_client);

--
Jesper Juhl <jj@chaosbits.net> http://www.chaosbits.net/
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please.



\
 
 \ /
  Last update: 2010-12-25 19:29    [W:0.295 / U:0.728 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site