Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-22 20:22:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

ceph: avoid a use-after-free in ceph_destroy_options()

Browse Source 
syzbot reported a use-after-free in ceph_destroy_options(), called from
ceph_mount().  The problem was that create_fs_client() consumed the opt
pointer on some errors, but not on all of them.  Make sure it always
consumes both libceph and ceph options.

Reported-by: syzbot+8ab6f1042021b4eed062@syzkaller.appspotmail.com
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
This commit is contained in:
Ilya Dryomov 2018-08-24 15:32:43 +02:00
parent 57361846b5
commit 8aaff15168
1 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
fs/ceph/super.c
View File

@ -602,6 +602,8 @@ static int extra_mon_dispatch(struct ceph_client *client, struct ceph_msg *msg)
/* /*
* create a new fs client * create a new fs client
*
* Success or not, this function consumes @fsopt and @opt.
*/ */
static struct ceph_fs_client *create_fs_client(struct ceph_mount_options *fsopt, static struct ceph_fs_client *create_fs_client(struct ceph_mount_options *fsopt,
struct ceph_options *opt) struct ceph_options *opt)
@ -609,17 +611,20 @@ static struct ceph_fs_client *create_fs_client(struct ceph_mount_options *fsopt,
struct ceph_fs_client *fsc; struct ceph_fs_client *fsc;
int page_count; int page_count;
size_t size; size_t size;
int err = -ENOMEM; int err;
fsc = kzalloc(sizeof(*fsc), GFP_KERNEL); fsc = kzalloc(sizeof(*fsc), GFP_KERNEL);
if (!fsc) if (!fsc) {
return ERR_PTR(-ENOMEM); err = -ENOMEM;
goto fail;
}
fsc->client = ceph_create_client(opt, fsc); fsc->client = ceph_create_client(opt, fsc);
if (IS_ERR(fsc->client)) { if (IS_ERR(fsc->client)) {
err = PTR_ERR(fsc->client); err = PTR_ERR(fsc->client);
goto fail; goto fail;
} }
opt = NULL; /* fsc->client now owns this */
fsc->client->extra_mon_dispatch = extra_mon_dispatch; fsc->client->extra_mon_dispatch = extra_mon_dispatch;
fsc->client->osdc.abort_on_full = true; fsc->client->osdc.abort_on_full = true;
@ -677,6 +682,9 @@ fail_client:
ceph_destroy_client(fsc->client); ceph_destroy_client(fsc->client);
fail: fail:
kfree(fsc); kfree(fsc);
if (opt)
ceph_destroy_options(opt);
destroy_mount_options(fsopt);
return ERR_PTR(err); return ERR_PTR(err);
} }
@ -1042,8 +1050,6 @@ static struct dentry *ceph_mount(struct file_system_type *fs_type,
fsc = create_fs_client(fsopt, opt); fsc = create_fs_client(fsopt, opt);
if (IS_ERR(fsc)) { if (IS_ERR(fsc)) {
res = ERR_CAST(fsc); res = ERR_CAST(fsc);
destroy_mount_options(fsopt);
ceph_destroy_options(opt);
goto out_final; goto out_final;
} }