summaryrefslogtreecommitdiffstats
path: root/fs/ceph
diff options
context:
space:
mode:
authorYan, Zheng <zyan@redhat.com>2017-03-29 09:30:24 +0200
committerIlya Dryomov <idryomov@gmail.com>2017-05-04 09:19:20 +0200
commit0a07fc8cd01b6838d999a5eacaa99fe90b8f768b (patch)
tree266cad4b91bc6eaf3be28e749e3228c1baf37a83 /fs/ceph
parentceph: allow connecting to mds whose rank >= mdsmap::m_max_mds (diff)
downloadlinux-0a07fc8cd01b6838d999a5eacaa99fe90b8f768b.tar.xz
linux-0a07fc8cd01b6838d999a5eacaa99fe90b8f768b.zip
ceph: fix potential use-after-free
__unregister_session() free the session if it drops the last reference. We should grab an extra reference if we want to use session after __unregister_session(). Signed-off-by: "Yan, Zheng" <zyan@redhat.com> Reviewed-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'fs/ceph')
-rw-r--r--fs/ceph/mds_client.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 2733932bf192..3bdff7ae7bfd 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2638,8 +2638,10 @@ static void handle_session(struct ceph_mds_session *session,
seq = le64_to_cpu(h->seq);
mutex_lock(&mdsc->mutex);
- if (op == CEPH_SESSION_CLOSE)
+ if (op == CEPH_SESSION_CLOSE) {
+ get_session(session);
__unregister_session(mdsc, session);
+ }
/* FIXME: this ttl calculation is generous */
session->s_ttl = jiffies + HZ*mdsc->mdsmap->m_session_autoclose;
mutex_unlock(&mdsc->mutex);
@@ -2728,6 +2730,8 @@ static void handle_session(struct ceph_mds_session *session,
kick_requests(mdsc, mds);
mutex_unlock(&mdsc->mutex);
}
+ if (op == CEPH_SESSION_CLOSE)
+ ceph_put_mds_session(session);
return;
bad:
@@ -3128,8 +3132,10 @@ static void check_new_map(struct ceph_mds_client *mdsc,
if (s->s_state == CEPH_MDS_SESSION_OPENING) {
/* the session never opened, just close it
* out now */
- __wake_requests(mdsc, &s->s_waiting);
+ get_session(s);
__unregister_session(mdsc, s);
+ __wake_requests(mdsc, &s->s_waiting);
+ ceph_put_mds_session(s);
} else {
/* just close it */
mutex_unlock(&mdsc->mutex);