diff options
| author | Sage Weil <sage@newdream.net> | 2010-09-27 10:18:52 -0700 |
|---|---|---|
| committer | Sage Weil <sage@newdream.net> | 2010-10-07 08:00:23 -0700 |
| commit | 6bc18876ba01fd4a077db6e1ed27201e4bda8864 (patch) | |
| tree | 145b14be550e359e2a5a9f594f54f870d46fd926 | |
| parent | 936aeb5c4a9fa799abd7d630a94223acedcaad50 (diff) | |
| download | linux-6bc18876ba01fd4a077db6e1ed27201e4bda8864.tar.gz linux-6bc18876ba01fd4a077db6e1ed27201e4bda8864.tar.bz2 linux-6bc18876ba01fd4a077db6e1ed27201e4bda8864.zip | |
ceph: avoid null deref in osd request error path
If we interrupt an osd request, we call __cancel_request, but it wasn't
verifying that req->r_osd was non-NULL before dereferencing it. This could
cause a crash if osds were flapping and we aborted a request on said osd.
Reported-by: Henry C Chang <henry_c_chang@tcloudcomputing.com>
Signed-off-by: Sage Weil <sage@newdream.net>
| -rw-r--r-- | fs/ceph/osd_client.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/ceph/osd_client.c b/fs/ceph/osd_client.c index dfced1dacbcd..3b5571b8ce22 100644 --- a/fs/ceph/osd_client.c +++ b/fs/ceph/osd_client.c @@ -549,7 +549,7 @@ static void __unregister_request(struct ceph_osd_client *osdc, */ static void __cancel_request(struct ceph_osd_request *req) { - if (req->r_sent) { + if (req->r_sent && req->r_osd) { ceph_con_revoke(&req->r_osd->o_con, req->r_request); req->r_sent = 0; } |