Xiubo Li aaf67de788 ceph: fix potential use-after-free bug when trimming caps
When trimming the caps and just after the 'session->s_cap_lock' is
released in ceph_iterate_session_caps() the cap maybe removed by
another thread, and when using the stale cap memory in the callbacks
it will trigger use-after-free crash.

We need to check the existence of the cap just after the 'ci->i_ceph_lock'
being acquired. And do nothing if it's already removed.

Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/43272
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Luís Henriques <lhenriques@suse.de>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2023-04-30 12:37:28 +02:00
..
2023-01-19 09:24:28 +01:00
2023-01-19 09:24:26 +01:00
2023-02-20 11:53:11 -08:00
2022-01-11 22:13:01 +00:00
2020-06-01 13:22:51 +02:00
2022-05-25 20:45:14 +02:00
2022-03-01 18:26:37 +01:00