diff mbox series

[5.8,061/148] ceph: fix use-after-free for fsc->mdsc

Message ID	20200824082416.994206217@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=P6ku=CC=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, syzbot+b57f46d8d6ea51960b8c@syzkaller.appspotmail.com, Xiubo Li <xiubli@redhat.com>, Jeff Layton <jlayton@kernel.org>, Ilya Dryomov <idryomov@gmail.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.8 061/148] ceph: fix use-after-free for fsc->mdsc Date: Mon, 24 Aug 2020 10:29:19 +0200 Message-Id: <20200824082416.994206217@linuxfoundation.org> In-Reply-To: <20200824082413.900489417@linuxfoundation.org> References: <20200824082413.900489417@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.8,002/148] drm/panel-simple: Fix inverted V/H SYNC for Frida FRD350H54004 panel [5.8,005/148] khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() [5.8,009/148] can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in j1939_tp_... [5.8,011/148] spi: Prevent adding devices below an unregistering controller [5.8,012/148] io_uring: find and cancel head link async work on files exit [5.8,014/148] romfs: fix uninitialized memory leak in romfs_dev_read() [5.8,017/148] squashfs: avoid bio_alloc() failure with 1Mbyte blocks [5.8,018/148] mm: include CMA pages in lowmem_reserve at boot [5.8,019/148] mm, page_alloc: fix core hung in free_pcppages_bulk() [5.8,020/148] ASoC: amd: renoir: restore two more registers during resume [5.8,021/148] RDMA/hfi1: Correct an interlock issue for TID RDMA WRITE request [5.8,022/148] opp: Enable resources again if they were disabled earlier [5.8,023/148] opp: Put opp table in dev_pm_opp_set_rate() for empty tables [5.8,024/148] opp: Put opp table in dev_pm_opp_set_rate() if _set_opp_bw() fails [5.8,028/148] scsi: zfcp: Fix use-after-free in request timeout handlers [5.8,029/148] KVM: Pass MMU notifier range flags to kvm_unmap_hva_range() [5.8,033/148] s390/pci: fix PF/VF linking on hot plug [5.8,036/148] drm: amdgpu: Use the correct size when allocating memory [5.8,038/148] drm/amd/display: Fix incorrect backlight register offset for DCN [5.8,039/148] drm/amd/display: Fix EDID parsing after resume from suspend [5.8,040/148] drm/amd/display: Blank stream before destroying HDCP session [5.8,044/148] drm/i915: Provide the perf pmu.module [5.8,045/148] scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices [5.8,048/148] media: coda: jpeg: add NULL check after kmalloc [5.8,051/148] media: vpss: clean up resources in init [5.8,052/148] f2fs: should avoid inode eviction in synchronous path [5.8,054/148] MIPS: Fix unable to reserve memory for Crash kernel [5.8,055/148] m68knommu: fix overwriting of bits in ColdFire V3 cache control [5.8,056/148] svcrdma: Fix another Receive buffer leak [5.8,059/148] riscv: Fixup static_obj() fail [5.8,061/148] ceph: fix use-after-free for fsc->mdsc [5.8,064/148] scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases [5.8,067/148] tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dere... [5.8,069/148] alpha: fix annotation of io{read,write}{16,32}be() [5.8,070/148] fat: fix fat_ra_init() for data clusters == 0 [5.8,071/148] fs/signalfd.c: fix inconsistent return codes for signalfd4 [5.8,073/148] drm/virtio: fix missing dma_fence_put() in virtio_gpu_execbuffer_ioctl() [5.8,076/148] netfilter: nf_tables: nft_exthdr: the presence return value should be little-endian [5.8,077/148] spi: stm32: fixes suspend/resume management [5.8,078/148] ASoC: q6afe-dai: mark all widgets registers as SND_SOC_NOPM [5.8,079/148] ASoC: q6routing: add dummy register read/write function [5.8,085/148] can: j1939: transport: j1939_simple_recv(): ignore local J1939 messages send not by... [5.8,086/148] can: j1939: transport: add j1939_session_skb_find_by_offset() function [5.8,087/148] igc: Fix PTP initialization [5.8,088/148] i40e: Set RX_ONLY mode for unicast promiscuous on VLAN [5.8,091/148] bonding: show saner speed for broadcast mode [5.8,092/148] can: j1939: fix support for multipacket broadcast message [5.8,093/148] can: j1939: cancel rxtimer on multipacket broadcast session complete [5.8,096/148] bonding: fix a potential double-unregister [5.8,098/148] s390/runtime_instrumentation: fix storage key handling [5.8,100/148] ASoC: msm8916-wcd-analog: fix register Interrupt offset [5.8,103/148] vfio-pci: Avoid recursive read-lock usage [5.8,105/148] arch/ia64: Restore arch-specific pgd_offset_k implementation [5.8,107/148] kvm: x86: Toggling CR4.PKE does not load PDPTEs in PAE mode [5.8,108/148] of/address: check for invalid range.cpu_addr [5.8,109/148] scsi: ufs: ti-j721e-ufs: Fix error return in ti_j721e_ufs_probe() [5.8,114/148] scsi: ufs: Add quirk to fix abnormal ocs fatal error [5.8,120/148] efi: avoid error message when booting under Xen [5.8,121/148] Fix build error when CONFIG_ACPI is not set/enabled: [5.8,123/148] Revert "RDMA/hns: Reserve one sge in order to avoid local length error" [5.8,125/148] kconfig: qconf: remove qInfo() to get back Qt4 support [5.8,126/148] afs: Fix NULL deref in afs_dynroot_depopulate() [5.8,127/148] ARM64: vdso32: Install vdso32 from vdso_install [5.8,130/148] bpf: Use get_file_rcu() instead of get_file() for task_file iterator [5.8,132/148] bonding: fix active-backup failover for current ARP slave [5.8,134/148] net: ena: Change WARN_ON expression in ena_del_napi_in_range() [5.8,136/148] selftests/bpf: Remove test_align leftovers [5.8,138/148] net: dsa: b53: check for timeout [5.8,139/148] epoll: Keep a reference on files added to the check list [5.8,141/148] powerpc/pseries: Do not initiate shutdown when system is running on UPS [5.8,142/148] EDAC/{i7core,sb,pnd2,skx}: Fix error event severity [5.8,145/148] efi/libstub: Stop parsing arguments at "--" [5.8,147/148] efi/libstub: Handle unterminated cmdline

Commit Message

Greg KH Aug. 24, 2020, 8:29 a.m. UTC

From: Xiubo Li <xiubli@redhat.com>

[ Upstream commit a7caa88f8b72c136f9a401f498471b8a8e35370d ]

If the ceph_mdsc_init() fails, it will free the mdsc already.

Reported-by: syzbot+b57f46d8d6ea51960b8c@syzkaller.appspotmail.com
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mds_client.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index dea971f9d89ee..946f9a92658ab 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -4361,7 +4361,6 @@  int ceph_mdsc_init(struct ceph_fs_client *fsc)
 		goto err_mdsc;
 	}
 
-	fsc->mdsc = mdsc;
 	init_completion(&mdsc->safe_umount_waiters);
 	init_waitqueue_head(&mdsc->session_close_wq);
 	INIT_LIST_HEAD(&mdsc->waiting_for_map);
@@ -4416,6 +4415,8 @@  int ceph_mdsc_init(struct ceph_fs_client *fsc)
 
 	strscpy(mdsc->nodename, utsname()->nodename,
 		sizeof(mdsc->nodename));
+
+	fsc->mdsc = mdsc;
 	return 0;
 
 err_mdsmap: