Commit daf5cc27 authored by Al Viro's avatar Al Viro Committed by Ilya Dryomov

ceph: fix use-after-free on symlink traversal

free the symlink body after the same RCU delay we have for freeing the
struct inode itself, so that traversal during RCU pathwalk wouldn't step
into freed memory.
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent 187df763
...@@ -524,6 +524,7 @@ static void ceph_i_callback(struct rcu_head *head) ...@@ -524,6 +524,7 @@ static void ceph_i_callback(struct rcu_head *head)
struct inode *inode = container_of(head, struct inode, i_rcu); struct inode *inode = container_of(head, struct inode, i_rcu);
struct ceph_inode_info *ci = ceph_inode(inode); struct ceph_inode_info *ci = ceph_inode(inode);
kfree(ci->i_symlink);
kmem_cache_free(ceph_inode_cachep, ci); kmem_cache_free(ceph_inode_cachep, ci);
} }
...@@ -566,7 +567,6 @@ void ceph_destroy_inode(struct inode *inode) ...@@ -566,7 +567,6 @@ void ceph_destroy_inode(struct inode *inode)
} }
} }
kfree(ci->i_symlink);
while ((n = rb_first(&ci->i_fragtree)) != NULL) { while ((n = rb_first(&ci->i_fragtree)) != NULL) {
frag = rb_entry(n, struct ceph_inode_frag, node); frag = rb_entry(n, struct ceph_inode_frag, node);
rb_erase(n, &ci->i_fragtree); rb_erase(n, &ci->i_fragtree);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment