ceph: fix use-after-free for fsc->mdsc (a7caa88f) · Commits · 戴 / test

If the ceph_mdsc_init() fails, it will free the mdsc already. Reported-by:

fs/ceph/mds_client.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -4453,7 +4453,6 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc)
		goto err_mdsc;
		}

		fsc->mdsc = mdsc;
		init_completion(&mdsc->safe_umount_waiters);
		init_waitqueue_head(&mdsc->session_close_wq);
		INIT_LIST_HEAD(&mdsc->waiting_for_map);
		@@ -4508,6 +4507,8 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc)

		strscpy(mdsc->nodename, utsname()->nodename,
		sizeof(mdsc->nodename));

		fsc->mdsc = mdsc;
		return 0;

		err_mdsmap: