diff mbox series

[5.7,049/124] ceph: fix use-after-free for fsc->mdsc

Message ID	20200824082411.840340779@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=P6ku=CC=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, syzbot+b57f46d8d6ea51960b8c@syzkaller.appspotmail.com, Xiubo Li <xiubli@redhat.com>, Jeff Layton <jlayton@kernel.org>, Ilya Dryomov <idryomov@gmail.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.7 049/124] ceph: fix use-after-free for fsc->mdsc Date: Mon, 24 Aug 2020 10:29:43 +0200 Message-Id: <20200824082411.840340779@linuxfoundation.org> In-Reply-To: <20200824082409.368269240@linuxfoundation.org> References: <20200824082409.368269240@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.7,004/124] khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() [5.7,005/124] bcache: avoid nr_stripes overflow in bcache_device_init() [5.7,008/124] can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in j1939_tp_... [5.7,010/124] spi: Prevent adding devices below an unregistering controller [5.7,013/124] uprobes: __replace_page() avoid BUG in munlock_vma_page() [5.7,014/124] mm: include CMA pages in lowmem_reserve at boot [5.7,016/124] RDMA/hfi1: Correct an interlock issue for TID RDMA WRITE request [5.7,018/124] ext4: fix checking of directory entry validity for inline directories [5.7,021/124] selftests: kvm: Use a shorter encoding to clear RAX [5.7,022/124] mm/memory.c: skip spurious TLB flush for retried page fault [5.7,026/124] drm/amd/display: Fix DFPstate hang due to view port changed [5.7,027/124] drm/amd/display: fix pow() crashing when given base 0 [5.7,028/124] io-wq: reorder cancellation pending -> running [5.7,031/124] io_uring: find and cancel head link async work on files exit [5.7,033/124] opp: Reorder the code for !target_freq case [5.7,034/124] opp: Put opp table in dev_pm_opp_set_rate() for empty tables [5.7,037/124] media: budget-core: Improve exception handling in budget_register() [5.7,038/124] f2fs: fix to check page dirty status before writeback [5.7,040/124] media: vpss: clean up resources in init [5.7,043/124] m68knommu: fix overwriting of bits in ColdFire V3 cache control [5.7,046/124] drm/ttm: fix offset in VMAs with a pg_offs in ttm_bo_vm_access [5.7,048/124] jffs2: fix UAF problem [5.7,049/124] ceph: fix use-after-free for fsc->mdsc [5.7,051/124] cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0 [5.7,054/124] media: camss: fix memory leaks on error handling paths in probe [5.7,055/124] tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dere... [5.7,058/124] fs/signalfd.c: fix inconsistent return codes for signalfd4 [5.7,059/124] ext4: fix potential negative array index in do_split() [5.7,061/124] ext4: dont allow overlapping system zones [5.7,063/124] netfilter: nf_tables: nft_exthdr: the presence return value should be little-endian [5.7,064/124] spi: stm32: fixes suspend/resume management [5.7,065/124] ASoC: q6afe-dai: mark all widgets registers as SND_SOC_NOPM [5.7,066/124] ASoC: q6routing: add dummy register read/write function [5.7,067/124] tools/bpftool: Make skeleton code C++17-friendly by dropping typeof() [5.7,068/124] bpf: sock_ops ctx access may stomp registers in corner case [5.7,070/124] can: j1939: fix kernel-infoleak in j1939_sk_sock2sockaddr_can() [5.7,072/124] can: j1939: transport: add j1939_session_skb_find_by_offset() function [5.7,075/124] i40e: Fix crash during removing i40e driver [5.7,077/124] bonding: show saner speed for broadcast mode [5.7,078/124] can: j1939: fix support for multipacket broadcast message [5.7,081/124] can: j1939: add rxtimer for multipacket broadcast session [5.7,082/124] bonding: fix a potential double-unregister [5.7,083/124] ipvlan: fix device features [5.7,085/124] s390/ptrace: fix storage key handling [5.7,086/124] ASoC: msm8916-wcd-analog: fix register Interrupt offset [5.7,087/124] ASoC: intel: Fix memleak in sst_media_open [5.7,092/124] scsi: ufs: ti-j721e-ufs: Fix error return in ti_j721e_ufs_probe() [5.7,096/124] scsi: ufs: Introduce UFSHCD_QUIRK_PRDT_BYTE_GRAN quirk [5.7,098/124] scsi: ufs-pci: Add quirk for broken auto-hibernate for Intel EHL [5.7,099/124] scsi: ufs: Fix interrupt error message for shared interrupts [5.7,101/124] kconfig: qconf: do not limit the pop-up menu to the first row [5.7,104/124] Fix build error when CONFIG_ACPI is not set/enabled: [5.7,107/124] ARM64: vdso32: Install vdso32 from vdso_install [5.7,108/124] powerpc/fixmap: Fix the size of the early debug area [5.7,109/124] powerpc/pseries/hotplug-cpu: wait indefinitely for vCPU death [5.7,112/124] net: ena: Change WARN_ON expression in ena_del_napi_in_range() [5.7,113/124] net: gemini: Fix missing free_netdev() in error path of gemini_ethernet_port_probe() [5.7,114/124] hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit() [5.7,116/124] epoll: Keep a reference on files added to the check list [5.7,120/124] efi: add missed destroy_workqueue when efisubsys_init fails [5.7,122/124] efi/libstub: Handle NULL cmdline [5.7,123/124] do_epoll_ctl(): clean the failure exits up a bit

Commit Message

Greg Kroah-Hartman Aug. 24, 2020, 8:29 a.m. UTC

From: Xiubo Li <xiubli@redhat.com>

[ Upstream commit a7caa88f8b72c136f9a401f498471b8a8e35370d ]

If the ceph_mdsc_init() fails, it will free the mdsc already.

Reported-by: syzbot+b57f46d8d6ea51960b8c@syzkaller.appspotmail.com
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mds_client.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 95272ae36b058..e32935b68d0a4 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -4337,7 +4337,6 @@  int ceph_mdsc_init(struct ceph_fs_client *fsc)
 		return -ENOMEM;
 	}
 
-	fsc->mdsc = mdsc;
 	init_completion(&mdsc->safe_umount_waiters);
 	init_waitqueue_head(&mdsc->session_close_wq);
 	INIT_LIST_HEAD(&mdsc->waiting_for_map);
@@ -4390,6 +4389,8 @@  int ceph_mdsc_init(struct ceph_fs_client *fsc)
 
 	strscpy(mdsc->nodename, utsname()->nodename,
 		sizeof(mdsc->nodename));
+
+	fsc->mdsc = mdsc;
 	return 0;
 }