p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ceph: fix potential use-after-free in ceph_mdsc_build_path 

temp is not defined outside of the RCU critical section here. Ensure
we grab that value before we drop the rcu_read_lock.

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
This commit is contained in:
Jeff Layton 2019-04-26 13:33:39 -04:00 committed by Ilya Dryomov
parent ff4a80bf2d
commit 69a10fb3f4
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fs/ceph/mds_client.c
View File

@ -2089,13 +2089,14 @@ static inline u64 __get_oldest_tid(struct ceph_mds_client *mdsc)
* Encode hidden .snap dirs as a double /, i.e. * Encode hidden .snap dirs as a double /, i.e.
* foo/.snap/bar -> foo//bar * foo/.snap/bar -> foo//bar
*/ */
char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *base, char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *pbase,
int stop_on_nosnap) int stop_on_nosnap)
{ {
struct dentry *temp; struct dentry *temp;
char *path; char *path;
int len, pos; int len, pos;
unsigned seq; unsigned seq;
u64 base;
if (!dentry) if (!dentry)
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
@ -2151,6 +2152,7 @@ char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *base,
path[--pos] = '/'; path[--pos] = '/';
temp = temp->d_parent; temp = temp->d_parent;
} }
base = ceph_ino(d_inode(temp));
rcu_read_unlock(); rcu_read_unlock();
if (pos != 0 || read_seqretry(&rename_lock, seq)) { if (pos != 0 || read_seqretry(&rename_lock, seq)) {
pr_err("build_path did not end path lookup where " pr_err("build_path did not end path lookup where "
@ -2163,10 +2165,10 @@ char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *base,
goto retry; goto retry;
} }
*base = ceph_ino(d_inode(temp)); *pbase = base;
*plen = len; *plen = len;
dout("build_path on %p %d built %llx '%.*s'\n", dout("build_path on %p %d built %llx '%.*s'\n",
dentry, d_count(dentry), *base, len, path); dentry, d_count(dentry), base, len, path);
return path; return path;
} }