]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
ceph: fix potential mdsc use-after-free crash
authorXiubo Li <xiubli@redhat.com>
Wed, 1 Jul 2020 05:52:48 +0000 (01:52 -0400)
committerKhalid Elmously <khalid.elmously@canonical.com>
Wed, 16 Sep 2020 09:15:01 +0000 (05:15 -0400)
commit8978a1f9fd66bdd664972625004ec3494e32bcb5
tree69d83021a46836fbe7e51e58a27d9c1a79b3ac39
parent669ada54ae7a13bc72d02962240deaba22e4d0c4
ceph: fix potential mdsc use-after-free crash

BugLink: https://bugs.launchpad.net/bugs/1895174
[ Upstream commit fa9967734227b44acb1b6918033f9122dc7825b9 ]

Make sure the delayed work stopped before releasing the resources.

cancel_delayed_work_sync() will only guarantee that the work finishes
executing if the work is already in the ->worklist.  That means after
the cancel_delayed_work_sync() returns, it will leave the work requeued
if it was rearmed at the end. That can lead to a use after free once the
work struct is freed.

Fix it by flushing the delayed work instead of trying to cancel it, and
ensure that the work doesn't rearm if the mdsc is stopping.

URL: https://tracker.ceph.com/issues/46293
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
fs/ceph/mds_client.c