* [PATCH 1/2] ceph: check rinfo->dir_dir before dereferencing it.
@ 2013-09-28 12:34 Yan, Zheng
2013-09-28 12:34 ` [PATCH 2/2] ceph: fix use-after-free bug Yan, Zheng
2013-09-30 21:55 ` [PATCH 1/2] ceph: check rinfo->dir_dir before dereferencing it Sage Weil
0 siblings, 2 replies; 3+ messages in thread
From: Yan, Zheng @ 2013-09-28 12:34 UTC (permalink / raw)
To: ceph-devel; +Cc: sage, dan.carpenter, Yan, Zheng
From: "Yan, Zheng" <zheng.z.yan@intel.com>
Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
---
fs/ceph/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 49d4de0..6f0a35c 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1288,7 +1288,8 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req,
u64 r_readdir_offset = req->r_readdir_offset;
u32 frag = le32_to_cpu(rhead->args.readdir.frag);
- if (le32_to_cpu(rinfo->dir_dir->frag) != frag) {
+ if (rinfo->dir_dir &&
+ le32_to_cpu(rinfo->dir_dir->frag) != frag) {
dout("readdir_prepopulate got new frag %x -> %x\n",
frag, le32_to_cpu(rinfo->dir_dir->frag));
frag = le32_to_cpu(rinfo->dir_dir->frag);
--
1.8.1.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 2/2] ceph: fix use-after-free bug
2013-09-28 12:34 [PATCH 1/2] ceph: check rinfo->dir_dir before dereferencing it Yan, Zheng
@ 2013-09-28 12:34 ` Yan, Zheng
2013-09-30 21:55 ` [PATCH 1/2] ceph: check rinfo->dir_dir before dereferencing it Sage Weil
1 sibling, 0 replies; 3+ messages in thread
From: Yan, Zheng @ 2013-09-28 12:34 UTC (permalink / raw)
To: ceph-devel; +Cc: sage, dan.carpenter, Yan, Zheng
From: "Yan, Zheng" <zheng.z.yan@intel.com>
Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
---
fs/ceph/inode.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 6f0a35c..2ae1381 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -779,6 +779,7 @@ no_change:
rb_node = rb_next(rb_node);
rb_erase(&frag->node, &ci->i_fragtree);
kfree(frag);
+ frag = NULL;
}
if (!frag) {
frag = __get_or_create_frag(ci, id);
--
1.8.1.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 1/2] ceph: check rinfo->dir_dir before dereferencing it.
2013-09-28 12:34 [PATCH 1/2] ceph: check rinfo->dir_dir before dereferencing it Yan, Zheng
2013-09-28 12:34 ` [PATCH 2/2] ceph: fix use-after-free bug Yan, Zheng
@ 2013-09-30 21:55 ` Sage Weil
1 sibling, 0 replies; 3+ messages in thread
From: Sage Weil @ 2013-09-30 21:55 UTC (permalink / raw)
To: Yan, Zheng; +Cc: ceph-devel, dan.carpenter
Hi Yan,
I squashed these two patches into the commits they fix. master and
testing branches are updated+rebased.
NOTE: I've been treating these branches as a patch queue and rebase as
needed. If anyone is using the ceph-client.git tree as a basis for
development and is disrupted by this, let me know!
sage
On Sat, 28 Sep 2013, Yan, Zheng wrote:
> From: "Yan, Zheng" <zheng.z.yan@intel.com>
>
> Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
> ---
> fs/ceph/inode.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
> index 49d4de0..6f0a35c 100644
> --- a/fs/ceph/inode.c
> +++ b/fs/ceph/inode.c
> @@ -1288,7 +1288,8 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req,
> u64 r_readdir_offset = req->r_readdir_offset;
> u32 frag = le32_to_cpu(rhead->args.readdir.frag);
>
> - if (le32_to_cpu(rinfo->dir_dir->frag) != frag) {
> + if (rinfo->dir_dir &&
> + le32_to_cpu(rinfo->dir_dir->frag) != frag) {
> dout("readdir_prepopulate got new frag %x -> %x\n",
> frag, le32_to_cpu(rinfo->dir_dir->frag));
> frag = le32_to_cpu(rinfo->dir_dir->frag);
> --
> 1.8.1.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-09-30 21:55 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-28 12:34 [PATCH 1/2] ceph: check rinfo->dir_dir before dereferencing it Yan, Zheng
2013-09-28 12:34 ` [PATCH 2/2] ceph: fix use-after-free bug Yan, Zheng
2013-09-30 21:55 ` [PATCH 1/2] ceph: check rinfo->dir_dir before dereferencing it Sage Weil
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).