iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ceph: fix potential bad pointer deref in async dirops cb's

Browse Source 
The new async dirops callback routines can pass ERR_PTR values to
ceph_mdsc_free_path, which could cause an oops. Make ceph_mdsc_free_path
ignore ERR_PTR values. Also, ensure that the pr_warn messages look sane
even if ceph_mdsc_build_path fails.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
This commit is contained in:
Jeff Layton 2020-04-08 08:41:38 -04:00 committed by Ilya Dryomov
parent 8ae0299a4b
commit 2a575f138d
3 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fs/ceph/dir.c
View File

@ -1051,8 +1051,8 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc,
/* If op failed, mark everyone involved for errors */ /* If op failed, mark everyone involved for errors */
if (result) { if (result) {
int pathlen; int pathlen = 0;
u64 base; u64 base = 0;
char *path = ceph_mdsc_build_path(req->r_dentry, &pathlen, char *path = ceph_mdsc_build_path(req->r_dentry, &pathlen,
&base, 0); &base, 0);

4
fs/ceph/file.c
View File

@ -527,8 +527,8 @@ static void ceph_async_create_cb(struct ceph_mds_client *mdsc,
if (result) { if (result) {
struct dentry *dentry = req->r_dentry; struct dentry *dentry = req->r_dentry;
int pathlen; int pathlen = 0;
u64 base; u64 base = 0;
char *path = ceph_mdsc_build_path(req->r_dentry, &pathlen, char *path = ceph_mdsc_build_path(req->r_dentry, &pathlen,
&base, 0); &base, 0);

2
fs/ceph/mds_client.h
View File

@ -521,7 +521,7 @@ extern void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc);
static inline void ceph_mdsc_free_path(char *path, int len) static inline void ceph_mdsc_free_path(char *path, int len)
{ {
if (path) if (!IS_ERR_OR_NULL(path))
__putname(path - (PATH_MAX - 1 - len)); __putname(path - (PATH_MAX - 1 - len));
} }