Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 62a65f36 authored by Yan, Zheng's avatar Yan, Zheng Committed by Ilya Dryomov
Browse files

ceph: avoid invalid memory dereference in the middle of umount 



extra_mon_dispatch() and debugfs' foo_show functions dereference
fsc->mdsc. we should clean up fsc->client->extra_mon_dispatch
and debugfs before destroying fsc->mds.

Signed-off-by: default avatar"Yan, Zheng" <zyan@redhat.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent 1684dd03

fs/ceph/mds_client.c

+2 −2
Original line number Diff line number Diff line
@@ -3769,13 +3769,13 @@ static void ceph_mdsc_stop(struct ceph_mds_client *mdsc) 
void ceph_mdsc_destroy(struct ceph_fs_client *fsc)

{

	struct ceph_mds_client *mdsc = fsc->mdsc;



	dout("mdsc_destroy %p\n", mdsc);

	ceph_mdsc_stop(mdsc);



	/* flush out any connection work with references to us */

	ceph_msgr_flush();



	ceph_mdsc_stop(mdsc);



	fsc->mdsc = NULL;

	kfree(mdsc);

	dout("mdsc_destroy %p done\n", mdsc);

fs/ceph/super.c

+4 −2
Original line number Diff line number Diff line
@@ -636,8 +636,6 @@ static void destroy_fs_client(struct ceph_fs_client *fsc) 


	destroy_mount_options(fsc->mount_options);



	ceph_fs_debugfs_cleanup(fsc);



	ceph_destroy_client(fsc->client);



	kfree(fsc);
@@ -1040,6 +1038,10 @@ static void ceph_kill_sb(struct super_block *s) 


	ceph_mdsc_pre_umount(fsc->mdsc);

	generic_shutdown_super(s);



	fsc->client->extra_mon_dispatch = NULL;

	ceph_fs_debugfs_cleanup(fsc);



	ceph_mdsc_destroy(fsc);



	destroy_fs_client(fsc);