summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorIlya Dryomov <idryomov@gmail.com>2016-09-15 18:05:16 +0200
committerIlya Dryomov <idryomov@gmail.com>2016-10-03 16:13:49 +0200
commit04dc923c9e4c43df7d2d94f290189785d3172326 (patch)
tree1ff276268fd5d3029281e2fa0b31fe2d5d9df053
parent7c84883adf6dc614fc9e01304aa1813a55c43ad2 (diff)
rbd: img_data requests don't own their page array
Move the check into rbd_obj_request_destroy() to avoid use-after-free on errors in rbd_img_request_fill(..., OBJ_REQUEST_PAGES, ...), where pages, owned by the caller, gets freed in rbd_img_request_fill(). Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Alex Elder <elder@linaro.org> Reviewed-by: David Disseldorp <ddiss@suse.de>
-rw-r--r--drivers/block/rbd.c11
1 files changed, 3 insertions, 8 deletions
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 02e9a0f0bf7b..e46f4f05fb01 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -2147,7 +2147,9 @@ static void rbd_obj_request_destroy(struct kref *kref)
bio_chain_put(obj_request->bio_list);
break;
case OBJ_REQUEST_PAGES:
- if (obj_request->pages)
+ /* img_data requests don't own their page array */
+ if (obj_request->pages &&
+ !obj_request_img_data_test(obj_request))
ceph_release_page_vector(obj_request->pages,
obj_request->page_count);
break;
@@ -2368,13 +2370,6 @@ static bool rbd_img_obj_end_request(struct rbd_obj_request *obj_request)
xferred = obj_request->length;
}
- /* Image object requests don't own their page array */
-
- if (obj_request->type == OBJ_REQUEST_PAGES) {
- obj_request->pages = NULL;
- obj_request->page_count = 0;
- }
-
if (img_request_child_test(img_request)) {
rbd_assert(img_request->obj_request != NULL);
more = obj_request->which < img_request->obj_request_count - 1;