diff options
| author | Ilya Dryomov <idryomov@gmail.com> | 2023-02-24 20:48:54 +0300 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2023-02-26 22:03:14 +0300 |
| commit | f7c4d9b133c7a04ca619355574e96b6abf209fba (patch) | |
| tree | b1d192d0f0163165d7a1c2e07e5e52335554f2a1 /fs | |
| parent | e027253c4b77d395798600a90b6a96fe4adf4d5e (diff) | |
| download | linux-f7c4d9b133c7a04ca619355574e96b6abf209fba.tar.xz | |
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
If getting an ID or setting up a work queue in rbd_dev_create() fails,
use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts
is triggered in do_rbd_add(). The root cause is that the ownership of
these structures is transfered to rbd_dev prematurely and they all end
up getting freed when rbd_dev_create() calls rbd_dev_free() prior to
returning to do_rbd_add().
Found by Linux Verification Center (linuxtesting.org) with SVACE, an
incomplete patch submitted by Natalia Petrova <n.petrova@fintech.ru>.
Cc: stable@vger.kernel.org
Fixes: 1643dfa4c2c8 ("rbd: introduce a per-device ordered workqueue")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'fs')
0 files changed, 0 insertions, 0 deletions