From: Yan, Zheng Date: Thu, 22 Jun 2017 08:26:34 +0000 (+0800) Subject: ceph: avoid invalid memory dereference in the middle of umount X-Git-Tag: v4.13-rc1~58^2~36 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=62a65f36d016fff32179acdbfcb8b2d8d9e54757;p=platform%2Fkernel%2Flinux-exynos.git ceph: avoid invalid memory dereference in the middle of umount extra_mon_dispatch() and debugfs' foo_show functions dereference fsc->mdsc. we should clean up fsc->client->extra_mon_dispatch and debugfs before destroying fsc->mds. Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov --- diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 0c05df4..666a9f2 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -3769,13 +3769,13 @@ static void ceph_mdsc_stop(struct ceph_mds_client *mdsc) void ceph_mdsc_destroy(struct ceph_fs_client *fsc) { struct ceph_mds_client *mdsc = fsc->mdsc; - dout("mdsc_destroy %p\n", mdsc); - ceph_mdsc_stop(mdsc); /* flush out any connection work with references to us */ ceph_msgr_flush(); + ceph_mdsc_stop(mdsc); + fsc->mdsc = NULL; kfree(mdsc); dout("mdsc_destroy %p done\n", mdsc); diff --git a/fs/ceph/super.c b/fs/ceph/super.c index 8d7918c..14e78dd 100644 --- a/fs/ceph/super.c +++ b/fs/ceph/super.c @@ -636,8 +636,6 @@ static void destroy_fs_client(struct ceph_fs_client *fsc) destroy_mount_options(fsc->mount_options); - ceph_fs_debugfs_cleanup(fsc); - ceph_destroy_client(fsc->client); kfree(fsc); @@ -1040,6 +1038,10 @@ static void ceph_kill_sb(struct super_block *s) ceph_mdsc_pre_umount(fsc->mdsc); generic_shutdown_super(s); + + fsc->client->extra_mon_dispatch = NULL; + ceph_fs_debugfs_cleanup(fsc); + ceph_mdsc_destroy(fsc); destroy_fs_client(fsc);