diff options
| author | Ilya Dryomov <idryomov@gmail.com> | 2018-08-24 15:32:43 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-10-10 08:55:57 +0200 |
| commit | 131a6926fa4d923802ba02832ff546cb1c5d145e (patch) | |
| tree | 34275ecce050c3204acc7552b1c0819af64476f7 /fs | |
| parent | e5f09c519ea04a5651bc309552da3c70e370abb5 (diff) | |
| download | linux-stable-131a6926fa4d923802ba02832ff546cb1c5d145e.tar.gz linux-stable-131a6926fa4d923802ba02832ff546cb1c5d145e.tar.bz2 linux-stable-131a6926fa4d923802ba02832ff546cb1c5d145e.zip | |
ceph: avoid a use-after-free in ceph_destroy_options()
[ Upstream commit 8aaff15168cfbc7c8980fdb0e8a585f1afe56ec0 ]
syzbot reported a use-after-free in ceph_destroy_options(), called from
ceph_mount(). The problem was that create_fs_client() consumed the opt
pointer on some errors, but not on all of them. Make sure it always
consumes both libceph and ceph options.
Reported-by: syzbot+8ab6f1042021b4eed062@syzkaller.appspotmail.com
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ceph/super.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/fs/ceph/super.c b/fs/ceph/super.c index 95a3b3ac9b6e..60f81ac369b5 100644 --- a/fs/ceph/super.c +++ b/fs/ceph/super.c @@ -603,6 +603,8 @@ static int extra_mon_dispatch(struct ceph_client *client, struct ceph_msg *msg) /* * create a new fs client + * + * Success or not, this function consumes @fsopt and @opt. */ static struct ceph_fs_client *create_fs_client(struct ceph_mount_options *fsopt, struct ceph_options *opt) @@ -610,17 +612,20 @@ static struct ceph_fs_client *create_fs_client(struct ceph_mount_options *fsopt, struct ceph_fs_client *fsc; int page_count; size_t size; - int err = -ENOMEM; + int err; fsc = kzalloc(sizeof(*fsc), GFP_KERNEL); - if (!fsc) - return ERR_PTR(-ENOMEM); + if (!fsc) { + err = -ENOMEM; + goto fail; + } fsc->client = ceph_create_client(opt, fsc); if (IS_ERR(fsc->client)) { err = PTR_ERR(fsc->client); goto fail; } + opt = NULL; /* fsc->client now owns this */ fsc->client->extra_mon_dispatch = extra_mon_dispatch; fsc->client->osdc.abort_on_full = true; @@ -678,6 +683,9 @@ fail_client: ceph_destroy_client(fsc->client); fail: kfree(fsc); + if (opt) + ceph_destroy_options(opt); + destroy_mount_options(fsopt); return ERR_PTR(err); } @@ -1042,8 +1050,6 @@ static struct dentry *ceph_mount(struct file_system_type *fs_type, fsc = create_fs_client(fsopt, opt); if (IS_ERR(fsc)) { res = ERR_CAST(fsc); - destroy_mount_options(fsopt); - ceph_destroy_options(opt); goto out_final; } |