]> git.baikalelectronics.ru Git - kernel.git/commit
ceph: avoid a use-after-free in ceph_destroy_options()
authorIlya Dryomov <idryomov@gmail.com>
Fri, 24 Aug 2018 13:32:43 +0000 (15:32 +0200)
committerIlya Dryomov <idryomov@gmail.com>
Thu, 6 Sep 2018 14:18:04 +0000 (16:18 +0200)
commita71f564b0ae8c4eead42bf43c0812bf298ce06c0
treef006f46f881823faaa069d4261ebf6bd9cc1265f
parent77e0a4623a7dc6c49e4b731092b7a6d5605e640c
ceph: avoid a use-after-free in ceph_destroy_options()

syzbot reported a use-after-free in ceph_destroy_options(), called from
ceph_mount().  The problem was that create_fs_client() consumed the opt
pointer on some errors, but not on all of them.  Make sure it always
consumes both libceph and ceph options.

Reported-by: syzbot+8ab6f1042021b4eed062@syzkaller.appspotmail.com
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
fs/ceph/super.c