diff options
| author | Ilya Dryomov <idryomov@gmail.com> | 2018-08-24 16:32:43 +0300 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2018-09-06 17:18:04 +0300 |
| commit | 8aaff15168cfbc7c8980fdb0e8a585f1afe56ec0 (patch) | |
| tree | f006f46f881823faaa069d4261ebf6bd9cc1265f /drivers/block/rbd.c | |
| parent | 57361846b52bc686112da6ca5368d11210796804 (diff) | |
| download | linux-8aaff15168cfbc7c8980fdb0e8a585f1afe56ec0.tar.xz | |
ceph: avoid a use-after-free in ceph_destroy_options()
syzbot reported a use-after-free in ceph_destroy_options(), called from
ceph_mount(). The problem was that create_fs_client() consumed the opt
pointer on some errors, but not on all of them. Make sure it always
consumes both libceph and ceph options.
Reported-by: syzbot+8ab6f1042021b4eed062@syzkaller.appspotmail.com
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Diffstat (limited to 'drivers/block/rbd.c')
0 files changed, 0 insertions, 0 deletions