lkml.org 
[lkml]   [2020]   [Aug]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 053/107] ceph: fix use-after-free for fsc->mdsc
    Date
    From: Xiubo Li <xiubli@redhat.com>

    [ Upstream commit a7caa88f8b72c136f9a401f498471b8a8e35370d ]

    If the ceph_mdsc_init() fails, it will free the mdsc already.

    Reported-by: syzbot+b57f46d8d6ea51960b8c@syzkaller.appspotmail.com
    Signed-off-by: Xiubo Li <xiubli@redhat.com>
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/ceph/mds_client.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
    index 701bc3f4d4ba1..b0077f5a31688 100644
    --- a/fs/ceph/mds_client.c
    +++ b/fs/ceph/mds_client.c
    @@ -4143,7 +4143,6 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc)
    return -ENOMEM;
    }

    - fsc->mdsc = mdsc;
    init_completion(&mdsc->safe_umount_waiters);
    init_waitqueue_head(&mdsc->session_close_wq);
    INIT_LIST_HEAD(&mdsc->waiting_for_map);
    @@ -4195,6 +4194,8 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc)

    strscpy(mdsc->nodename, utsname()->nodename,
    sizeof(mdsc->nodename));
    +
    + fsc->mdsc = mdsc;
    return 0;
    }

    --
    2.25.1


    \
     
     \ /
      Last update: 2020-08-24 10:47    [W:4.024 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site