ceph: fix potential bad pointer deref in async dirops cb's (2a575f13) · Commits · 戴 / test

The new async dirops callback routines can pass ERR_PTR values to ceph_mdsc_free_path, which could cause an oops. Make ceph_mdsc_free_path ignore ERR_PTR values. Also, ensure that the pr_warn messages look sane even if ceph_mdsc_build_path fails. Reported-by:

Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:

Jeff Layton <jlayton@kernel.org> Reviewed-by:

Ilya Dryomov <idryomov@gmail.com> Signed-off-by:

Ilya Dryomov <idryomov@gmail.com>

fs/ceph/dir.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1051,8 +1051,8 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc,

		/* If op failed, mark everyone involved for errors */
		if (result) {
		int pathlen;
		u64 base;
		int pathlen = 0;
		u64 base = 0;
		char *path = ceph_mdsc_build_path(req->r_dentry, &pathlen,
		&base, 0);

fs/ceph/file.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -527,8 +527,8 @@ static void ceph_async_create_cb(struct ceph_mds_client *mdsc,

		if (result) {
		struct dentry *dentry = req->r_dentry;
		int pathlen;
		u64 base;
		int pathlen = 0;
		u64 base = 0;
		char *path = ceph_mdsc_build_path(req->r_dentry, &pathlen,
		&base, 0);

fs/ceph/mds_client.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -521,7 +521,7 @@ extern void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc);

		static inline void ceph_mdsc_free_path(char *path, int len)
		{
		if (path)
		if (!IS_ERR_OR_NULL(path))
		__putname(path - (PATH_MAX - 1 - len));
		}

Admin message