diff options
| author | Ilya Dryomov <idryomov@gmail.com> | 2018-05-22 16:26:51 +0200 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2018-06-04 20:45:59 +0200 |
| commit | 6001567c14eb8e93f8bceb35fc02158a3e1f20f8 (patch) | |
| tree | f3eb8665a17131852e844453c281750cffcdc56c /net | |
| parent | libceph: don't warn if req->r_abort_on_full is set (diff) | |
| download | linux-6001567c14eb8e93f8bceb35fc02158a3e1f20f8.tar.xz linux-6001567c14eb8e93f8bceb35fc02158a3e1f20f8.zip | |
libceph: avoid a use-after-free during map check
Sending map check after complete_request() was called is not only
useless, but can lead to a use-after-free as req->r_kref decrement in
__complete_request() races with map check code.
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ceph/osd_client.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c index 34b5334548c3..294320400c72 100644 --- a/net/ceph/osd_client.c +++ b/net/ceph/osd_client.c @@ -2266,7 +2266,7 @@ again: complete_request(req, err); mutex_unlock(&osd->lock); - if (ct_res == CALC_TARGET_POOL_DNE) + if (!err && ct_res == CALC_TARGET_POOL_DNE) send_map_check(req); if (promoted) |