* [PATCH] libceph: fix use after free
@ 2018-11-27 7:02 Pan Bian
2018-11-27 8:47 ` Sergei Shtylyov
0 siblings, 1 reply; 3+ messages in thread
From: Pan Bian @ 2018-11-27 7:02 UTC (permalink / raw)
To: Ilya Dryomov, Yan, Zheng, Sage Weil, David S. Miller
Cc: ceph-devel, netdev, linux-kernel, Pan Bian
The function ceph_monc_handle_map calls kfree(old) to free the old
monitor map, old points to monc->monmap. However, after that, it reads
monc->monmap->epoch and passes it to __ceph_monc_got_map. This result in
a use-after-free bug. The patch moves the free operation after the call
to __ceph_monc_got_map.
Fixes: 82dcabad750("libceph: revamp subs code, switch to SUBSCRIBE2
protocol")
Signed-off-by: Pan Bian <bianpan2016@163.com>
---
net/ceph/mon_client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 18deb3d..05ef5aa 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -478,9 +478,10 @@ static void ceph_monc_handle_map(struct ceph_mon_client *monc,
}
client->monc.monmap = monmap;
- kfree(old);
__ceph_monc_got_map(monc, CEPH_SUB_MONMAP, monc->monmap->epoch);
+ kfree(old);
+
client->have_fsid = true;
out:
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] libceph: fix use after free
2018-11-27 7:02 [PATCH] libceph: fix use after free Pan Bian
@ 2018-11-27 8:47 ` Sergei Shtylyov
2018-11-27 9:09 ` PanBian
0 siblings, 1 reply; 3+ messages in thread
From: Sergei Shtylyov @ 2018-11-27 8:47 UTC (permalink / raw)
To: Pan Bian, Ilya Dryomov, Yan, Zheng, Sage Weil, David S. Miller
Cc: ceph-devel, netdev, linux-kernel
Hello!
On 27.11.2018 10:02, Pan Bian wrote:
> The function ceph_monc_handle_map calls kfree(old) to free the old
> monitor map, old points to monc->monmap. However, after that, it reads
> monc->monmap->epoch and passes it to __ceph_monc_got_map. This result in
> a use-after-free bug. The patch moves the free operation after the call
> to __ceph_monc_got_map.
>
> Fixes: 82dcabad750("libceph: revamp subs code, switch to SUBSCRIBE2
Space needed before (.
> protocol")
Never break up the commit summary in this tag.
> Signed-off-by: Pan Bian <bianpan2016@163.com>
[...]
MBR, Sergei
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] libceph: fix use after free
2018-11-27 8:47 ` Sergei Shtylyov
@ 2018-11-27 9:09 ` PanBian
0 siblings, 0 replies; 3+ messages in thread
From: PanBian @ 2018-11-27 9:09 UTC (permalink / raw)
To: Sergei Shtylyov
Cc: Ilya Dryomov, Yan, Zheng, Sage Weil, DavidS.Miller, ceph-devel,
netdev, linux-kernel
On Tue, Nov 27, 2018 at 11:47:56AM +0300, Sergei Shtylyov wrote:
> Hello!
>
> On 27.11.2018 10:02, Pan Bian wrote:
>
> >The function ceph_monc_handle_map calls kfree(old) to free the old
> >monitor map, old points to monc->monmap. However, after that, it reads
> >monc->monmap->epoch and passes it to __ceph_monc_got_map. This result in
> >a use-after-free bug. The patch moves the free operation after the call
> >to __ceph_monc_got_map.
> >
> >Fixes: 82dcabad750("libceph: revamp subs code, switch to SUBSCRIBE2
>
> Space needed before (.
>
> >protocol")
>
> Never break up the commit summary in this tag.
Thanks for the guidance, I will correct it.
>
> >Signed-off-by: Pan Bian <bianpan2016@163.com>
> [...]
>
> MBR, Sergei
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-11-27 9:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-11-27 7:02 [PATCH] libceph: fix use after free Pan Bian
2018-11-27 8:47 ` Sergei Shtylyov
2018-11-27 9:09 ` PanBian
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.