* Use-after-free error in rbd_add()
@ 2013-05-09 22:42 Bjorn Helgaas
2013-05-10 2:09 ` Alex Elder
0 siblings, 1 reply; 2+ messages in thread
From: Bjorn Helgaas @ 2013-05-09 22:42 UTC (permalink / raw)
To: Alex Elder; +Cc: Sage Weil, ceph-devel
I think b536f69a3a5 "rbd: set up devices only for mapped images"
introduced a use-after-free error in rbd_add():
@@ -4964,9 +4960,12 @@ static ssize_t rbd_add(struct bus_type *bus,
if (rc < 0)
goto err_out_rbd_dev;
- return count;
+ rc = rbd_dev_device_setup(rbd_dev);
+ if (!rc)
+ return count;
+
+ rbd_dev_image_release(rbd_dev);
err_out_rbd_dev:
- kfree(rbd_dev->header_name);
rbd_dev_destroy(rbd_dev);
If rbd_dev_device_setup() returns an error, we call
rbd_dev_image_release(), which ultimately kfrees rbd_dev. Then we
call rbd_dev_destroy(), which references fields in the already-freed
rbd_dev struct before kfreeing it again.
Found by Coverity (CID 1020653).
Bjorn
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Use-after-free error in rbd_add()
2013-05-09 22:42 Use-after-free error in rbd_add() Bjorn Helgaas
@ 2013-05-10 2:09 ` Alex Elder
0 siblings, 0 replies; 2+ messages in thread
From: Alex Elder @ 2013-05-10 2:09 UTC (permalink / raw)
To: Bjorn Helgaas; +Cc: Sage Weil, ceph-devel
On 05/09/2013 05:42 PM, Bjorn Helgaas wrote:
> I think b536f69a3a5 "rbd: set up devices only for mapped images"
> introduced a use-after-free error in rbd_add():
>
> @@ -4964,9 +4960,12 @@ static ssize_t rbd_add(struct bus_type *bus,
> if (rc < 0)
> goto err_out_rbd_dev;
>
> - return count;
> + rc = rbd_dev_device_setup(rbd_dev);
> + if (!rc)
> + return count;
> +
> + rbd_dev_image_release(rbd_dev);
> err_out_rbd_dev:
> - kfree(rbd_dev->header_name);
> rbd_dev_destroy(rbd_dev);
>
> If rbd_dev_device_setup() returns an error, we call
> rbd_dev_image_release(), which ultimately kfrees rbd_dev. Then we
> call rbd_dev_destroy(), which references fields in the already-freed
> rbd_dev struct before kfreeing it again.
Thank you. I think you're right, I'll try to
have a fix prepared tomorrow.
-Alex
> Found by Coverity (CID 1020653).
>
> Bjorn
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-05-10 2:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-05-09 22:42 Use-after-free error in rbd_add() Bjorn Helgaas
2013-05-10 2:09 ` Alex Elder
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.