summaryrefslogtreecommitdiff
path: root/fs/ceph
diff options
context:
space:
mode:
authorSage Weil <sage@newdream.net>2010-09-27 21:18:52 +0400
committerSage Weil <sage@newdream.net>2010-10-07 19:00:23 +0400
commit6bc18876ba01fd4a077db6e1ed27201e4bda8864 (patch)
tree145b14be550e359e2a5a9f594f54f870d46fd926 /fs/ceph
parent936aeb5c4a9fa799abd7d630a94223acedcaad50 (diff)
downloadlinux-6bc18876ba01fd4a077db6e1ed27201e4bda8864.tar.xz
ceph: avoid null deref in osd request error path
If we interrupt an osd request, we call __cancel_request, but it wasn't verifying that req->r_osd was non-NULL before dereferencing it. This could cause a crash if osds were flapping and we aborted a request on said osd. Reported-by: Henry C Chang <henry_c_chang@tcloudcomputing.com> Signed-off-by: Sage Weil <sage@newdream.net>
Diffstat (limited to 'fs/ceph')
-rw-r--r--fs/ceph/osd_client.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/ceph/osd_client.c b/fs/ceph/osd_client.c
index dfced1dacbcd..3b5571b8ce22 100644
--- a/fs/ceph/osd_client.c
+++ b/fs/ceph/osd_client.c
@@ -549,7 +549,7 @@ static void __unregister_request(struct ceph_osd_client *osdc,
*/
static void __cancel_request(struct ceph_osd_request *req)
{
- if (req->r_sent) {
+ if (req->r_sent && req->r_osd) {
ceph_con_revoke(&req->r_osd->o_con, req->r_request);
req->r_sent = 0;
}