diff options
| author | Yan, Zheng <zyan@redhat.com> | 2017-03-29 10:30:24 +0300 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2017-05-04 10:19:20 +0300 |
| commit | 0a07fc8cd01b6838d999a5eacaa99fe90b8f768b (patch) | |
| tree | 266cad4b91bc6eaf3be28e749e3228c1baf37a83 /fs/ceph | |
| parent | 76201b6354bb3aa31c7ba2bd42b9cbb8dda71c44 (diff) | |
| download | linux-0a07fc8cd01b6838d999a5eacaa99fe90b8f768b.tar.xz | |
ceph: fix potential use-after-free
__unregister_session() free the session if it drops the last
reference. We should grab an extra reference if we want to use
session after __unregister_session().
Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'fs/ceph')
| -rw-r--r-- | fs/ceph/mds_client.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 2733932bf192..3bdff7ae7bfd 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -2638,8 +2638,10 @@ static void handle_session(struct ceph_mds_session *session, seq = le64_to_cpu(h->seq); mutex_lock(&mdsc->mutex); - if (op == CEPH_SESSION_CLOSE) + if (op == CEPH_SESSION_CLOSE) { + get_session(session); __unregister_session(mdsc, session); + } /* FIXME: this ttl calculation is generous */ session->s_ttl = jiffies + HZ*mdsc->mdsmap->m_session_autoclose; mutex_unlock(&mdsc->mutex); @@ -2728,6 +2730,8 @@ static void handle_session(struct ceph_mds_session *session, kick_requests(mdsc, mds); mutex_unlock(&mdsc->mutex); } + if (op == CEPH_SESSION_CLOSE) + ceph_put_mds_session(session); return; bad: @@ -3128,8 +3132,10 @@ static void check_new_map(struct ceph_mds_client *mdsc, if (s->s_state == CEPH_MDS_SESSION_OPENING) { /* the session never opened, just close it * out now */ - __wake_requests(mdsc, &s->s_waiting); + get_session(s); __unregister_session(mdsc, s); + __wake_requests(mdsc, &s->s_waiting); + ceph_put_mds_session(s); } else { /* just close it */ mutex_unlock(&mdsc->mutex); |