Unverified Commit e89f08c2 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6096 [sync] PR-6029: ceph: prevent use-after-free in encode_cap_msg() 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/6029 
 
PR sync from: Long Li <leo.lilong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/PYNTYYRT4GPYPVKMBOYRUWVRM764ZRDW/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9E2GN 
 
Link:https://gitee.com/openeuler/kernel/pulls/6096

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents d0010b0a d4287cf6

fs/ceph/caps.c

+2 −1
Original line number Diff line number Diff line
@@ -1402,7 +1402,7 @@ static void __prep_cap(struct cap_msg_args *arg, struct ceph_cap *cap, 
	if (flushing & CEPH_CAP_XATTR_EXCL) {

		arg->old_xattr_buf = __ceph_build_xattrs_blob(ci);

		arg->xattr_version = ci->i_xattrs.version;

		arg->xattr_buf = ci->i_xattrs.blob;

		arg->xattr_buf = ceph_buffer_get(ci->i_xattrs.blob);

	} else {

		arg->xattr_buf = NULL;

		arg->old_xattr_buf = NULL;
@@ -1468,6 +1468,7 @@ static void __send_cap(struct cap_msg_args *arg, struct ceph_inode_info *ci) 
	encode_cap_msg(msg, arg);

	ceph_con_send(&arg->session->s_con, msg);

	ceph_buffer_put(arg->old_xattr_buf);

	ceph_buffer_put(arg->xattr_buf);

	if (arg->wake)

		wake_up_all(&ci->i_cap_wq);

}