Unverified Commit 5103a776 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14895 ceph: prevent use-after-free in encode_cap_msg() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Long Li <leo.lilong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/VNRFMI3YNGA2LANMJS5LCC3P26Z3WHTU/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9E2GN 
 
Link:https://gitee.com/openeuler/kernel/pulls/14895

 

Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents b401b887 fd4287e8

fs/ceph/caps.c

+2 −1
Original line number Diff line number Diff line
@@ -1347,7 +1347,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap, 
	if (flushing & CEPH_CAP_XATTR_EXCL) {

		old_blob = __ceph_build_xattrs_blob(ci);

		arg.xattr_version = ci->i_xattrs.version;

		arg.xattr_buf = ci->i_xattrs.blob;

		arg.xattr_buf = ceph_buffer_get(ci->i_xattrs.blob);

	} else {

		arg.xattr_buf = NULL;

	}
@@ -1387,6 +1387,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap, 
		dout("error sending cap msg, must requeue %p\n", inode);

		delayed = 1;

	}

	ceph_buffer_put(arg.xattr_buf);



	if (wake)

		wake_up_all(&ci->i_cap_wq);