Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 00bd8edb authored by Yan, Zheng's avatar Yan, Zheng Committed by Sage Weil
Browse files

ceph: fix null pointer dereference in discard_cap_releases() 



send_mds_reconnect() may call discard_cap_releases() after all
release messages have been dropped by cleanup_cap_releases()

Signed-off-by: default avatarYan, Zheng <zheng.z.yan@intel.com>
Reviewed-by: default avatarSage Weil <sage@inktank.com>
parent d90deda6

fs/ceph/mds_client.c

+12 −9
Original line number Diff line number Diff line
@@ -1462,15 +1462,18 @@ static void discard_cap_releases(struct ceph_mds_client *mdsc, 


	dout("discard_cap_releases mds%d\n", session->s_mds);



	if (!list_empty(&session->s_cap_releases)) {

		/* zero out the in-progress message */

		msg = list_first_entry(&session->s_cap_releases,

					struct ceph_msg, list_head);

		head = msg->front.iov_base;

		num = le32_to_cpu(head->num);

	dout("discard_cap_releases mds%d %p %u\n", session->s_mds, msg, num);

		dout("discard_cap_releases mds%d %p %u\n",

		     session->s_mds, msg, num);

		head->num = cpu_to_le32(0);

		msg->front.iov_len = sizeof(*head);

		session->s_num_cap_releases += num;

	}



	/* requeue completed messages */

	while (!list_empty(&session->s_cap_releases_done)) {