8aaff15168
syzbot reported a use-after-free in ceph_destroy_options(), called from ceph_mount(). The problem was that create_fs_client() consumed the opt pointer on some errors, but not on all of them. Make sure it always consumes both libceph and ceph options. Reported-by: syzbot+8ab6f1042021b4eed062@syzkaller.appspotmail.com Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: "Yan, Zheng" <zyan@redhat.com> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| acl.c | ||
| addr.c | ||
| cache.c | ||
| cache.h | ||
| caps.c | ||
| ceph_frag.c | ||
| debugfs.c | ||
| dir.c | ||
| export.c | ||
| file.c | ||
| inode.c | ||
| ioctl.c | ||
| ioctl.h | ||
| locks.c | ||
| mds_client.c | ||
| mds_client.h | ||
| mdsmap.c | ||
| quota.c | ||
| snap.c | ||
| strings.c | ||
| super.c | ||
| super.h | ||
| xattr.c | ||