ceph: fix null pointer dereference in discard_cap_releases() (00bd8edb) · Commits · 戴 / test

send_mds_reconnect() may call discard_cap_releases() after all release messages have been dropped by cleanup_cap_releases() Signed-off-by:

fs/ceph/mds_client.c

+12 −9

Original line number	Diff line number	Diff line
		@@ -1462,15 +1462,18 @@ static void discard_cap_releases(struct ceph_mds_client *mdsc,

		dout("discard_cap_releases mds%d\n", session->s_mds);

		if (!list_empty(&session->s_cap_releases)) {
		/* zero out the in-progress message */
		msg = list_first_entry(&session->s_cap_releases,
		struct ceph_msg, list_head);
		head = msg->front.iov_base;
		num = le32_to_cpu(head->num);
		dout("discard_cap_releases mds%d %p %u\n", session->s_mds, msg, num);
		dout("discard_cap_releases mds%d %p %u\n",
		session->s_mds, msg, num);
		head->num = cpu_to_le32(0);
		msg->front.iov_len = sizeof(*head);
		session->s_num_cap_releases += num;
		}

		/* requeue completed messages */
		while (!list_empty(&session->s_cap_releases_done)) {