1. 23 Jan, 2020 29 commits
  2. 22 Jan, 2020 10 commits
  3. 21 Jan, 2020 1 commit
    • Jeff Layton's avatar
      ceph: hold extra reference to r_parent over life of request · 9c1c2b35
      Jeff Layton authored
      Currently, we just assume that it will stick around by virtue of the
      submitter's reference, but later patches will allow the syscall to
      return early and we can't rely on that reference at that point.
      
      While I'm not aware of any reports of it, Xiubo pointed out that this
      may fix a use-after-free.  If the wait for a reply times out or is
      canceled via signal, and then the reply comes in after the syscall
      returns, the client can end up trying to access r_parent without a
      reference.
      
      Take an extra reference to the inode when setting r_parent and release
      it when releasing the request.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJeff Layton <jlayton@kernel.org>
      Reviewed-by: default avatar"Yan, Zheng" <zyan@redhat.com>
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      9c1c2b35