diff options
| author | Xiubo Li <xiubli@redhat.com> | 2023-04-19 10:39:14 +0800 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2023-04-30 12:37:28 +0200 |
| commit | aaf67de78807c59c35bafb5003d4fb457c764800 (patch) | |
| tree | ca4240b921c125f5ec462f01284da73f6b182ca4 /fs/ceph/super.h | |
| parent | 7d41870d65db028234333c68e60a034ac335557a (diff) | |
| download | linux-aaf67de78807c59c35bafb5003d4fb457c764800.tar.gz linux-aaf67de78807c59c35bafb5003d4fb457c764800.tar.bz2 linux-aaf67de78807c59c35bafb5003d4fb457c764800.zip | |
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps and just after the 'session->s_cap_lock' is
released in ceph_iterate_session_caps() the cap maybe removed by
another thread, and when using the stale cap memory in the callbacks
it will trigger use-after-free crash.
We need to check the existence of the cap just after the 'ci->i_ceph_lock'
being acquired. And do nothing if it's already removed.
Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/43272
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Luís Henriques <lhenriques@suse.de>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'fs/ceph/super.h')
| -rw-r--r-- | fs/ceph/super.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/ceph/super.h b/fs/ceph/super.h index 6ecca2c6d137..d24bf0db5234 100644 --- a/fs/ceph/super.h +++ b/fs/ceph/super.h @@ -1192,6 +1192,8 @@ extern void ceph_kick_flushing_caps(struct ceph_mds_client *mdsc, struct ceph_mds_session *session); void ceph_kick_flushing_inode_caps(struct ceph_mds_session *session, struct ceph_inode_info *ci); +extern struct ceph_cap *__get_cap_for_mds(struct ceph_inode_info *ci, + int mds); extern struct ceph_cap *ceph_get_cap_for_mds(struct ceph_inode_info *ci, int mds); extern void ceph_take_cap_refs(struct ceph_inode_info *ci, int caps, |