ceph: avoid a use-after-free in ceph_destroy_options()
authorIlya Dryomov <idryomov@gmail.com>
Fri, 24 Aug 2018 13:32:43 +0000 (15:32 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 10 Oct 2018 06:55:57 +0000 (08:55 +0200)
commit131a6926fa4d923802ba02832ff546cb1c5d145e
tree34275ecce050c3204acc7552b1c0819af64476f7
parente5f09c519ea04a5651bc309552da3c70e370abb5
ceph: avoid a use-after-free in ceph_destroy_options()

[ Upstream commit 8aaff15168cfbc7c8980fdb0e8a585f1afe56ec0 ]

syzbot reported a use-after-free in ceph_destroy_options(), called from
ceph_mount().  The problem was that create_fs_client() consumed the opt
pointer on some errors, but not on all of them.  Make sure it always
consumes both libceph and ceph options.

Reported-by: syzbot+8ab6f1042021b4eed062@syzkaller.appspotmail.com
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/ceph/super.c