linux/fs/ceph
Xiubo Li fa99677342 ceph: fix potential mdsc use-after-free crash
Make sure the delayed work stopped before releasing the resources.

cancel_delayed_work_sync() will only guarantee that the work finishes
executing if the work is already in the ->worklist.  That means after
the cancel_delayed_work_sync() returns, it will leave the work requeued
if it was rearmed at the end. That can lead to a use after free once the
work struct is freed.

Fix it by flushing the delayed work instead of trying to cancel it, and
ensure that the work doesn't rearm if the mdsc is stopping.

URL: https://tracker.ceph.com/issues/46293
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2020-08-03 11:05:21 +02:00
..
acl.c ceph: add caps perf metric for each superblock 2020-06-01 13:22:51 +02:00
addr.c ceph: add read/write latency metric support 2020-06-01 13:22:51 +02:00
cache.c ceph: replace zero-length array with flexible-array member 2020-03-30 12:42:40 +02:00
cache.h libceph, rbd, ceph: convert to use the new mount API 2019-11-27 22:28:37 +01:00
caps.c ceph: add global total_caps to count the mdsc's total caps number 2020-08-03 11:05:15 +02:00
ceph_frag.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
debugfs.c ceph: add global total_caps to count the mdsc's total caps number 2020-08-03 11:05:15 +02:00
dir.c ceph: allow rename operation under different quota realms 2020-06-01 13:22:53 +02:00
export.c ceph: don't return -ESTALE if there's still an open file 2020-06-01 13:22:53 +02:00
file.c ceph: add read/write latency metric support 2020-06-01 13:22:51 +02:00
inode.c ceph: add caps perf metric for each superblock 2020-06-01 13:22:51 +02:00
io.c ceph: add buffered/direct exclusionary locking for reads and writes 2019-09-16 12:06:25 +02:00
io.h ceph: add buffered/direct exclusionary locking for reads and writes 2019-09-16 12:06:25 +02:00
ioctl.c ceph: consider inode's last read/write when calculating wanted caps 2020-03-30 12:42:42 +02:00
ioctl.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig ceph: add selinux support 2019-07-08 14:01:42 +02:00
locks.c ceph: check if file lock exists before sending unlock request 2020-03-30 12:42:40 +02:00
Makefile ceph: add dentry lease metric support 2020-06-01 13:22:51 +02:00
mds_client.c ceph: fix potential mdsc use-after-free crash 2020-08-03 11:05:21 +02:00
mds_client.h ceph: add check_session_state() helper and make it global 2020-08-03 11:05:10 +02:00
mdsmap.c ceph: add possible_max_rank and make the code more readable 2020-01-27 16:53:40 +01:00
metric.c ceph: add global total_caps to count the mdsc's total caps number 2020-08-03 11:05:15 +02:00
metric.h ceph: add global total_caps to count the mdsc's total caps number 2020-08-03 11:05:15 +02:00
quota.c ceph: allow rename operation under different quota realms 2020-06-01 13:22:53 +02:00
snap.c ceph: fix memory leak in ceph_cleanup_snapid_map() 2020-03-23 13:07:08 +01:00
strings.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
super.c ceph: perform asynchronous unlink if we have sufficient caps 2020-03-30 12:42:42 +02:00
super.h ceph: skip checking caps when session reconnecting and releasing reqs 2020-06-01 13:22:53 +02:00
util.c ceph: move net/ceph/ceph_fs.c to fs/ceph/util.c 2020-01-27 16:53:40 +01:00
xattr.c ceph: add caps perf metric for each superblock 2020-06-01 13:22:51 +02:00