diff options
| author | Wentao Liang <vulab@iscas.ac.cn> | 2026-09-17 16:27:04 +0000 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2026-10-26 14:15:47 +0100 |
| commit | e51cf76e7275d1bb5ad2d529bb00feade632dadc (patch) | |
| tree | 13e21573d4d706c75fe1189d7844f0e8e550005e | |
| parent | b3bf89767e3ca9506f1c7167cac97c41ec254d42 (diff) | |
| download | linux-e51cf76e7275d1bb5ad2d529bb00feade632dadc.tar.gz linux-e51cf76e7275d1bb5ad2d529bb00feade632dadc.zip | |
ceph: Fix xattr buffer leak in __send_cap()
__prep_cap() takes a reference on the xattr blob via ceph_buffer_get()
and also grabs a reference to the old xattr blob returned by
__ceph_build_xattrs_blob(). These references are normally dropped in
__send_cap() after the cap message has been sent, but when ceph_msg_new()
fails, __send_cap() requeues the cap and returns early without dropping
them, leaking both buffers on every allocation failure.
Release arg->old_xattr_buf and arg->xattr_buf on the ceph_msg_new()
failure path before returning.
Cc: stable@vger.kernel.org
Fixes: 16d68903f56a ("ceph: break up send_cap_msg")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
| -rw-r--r-- | fs/ceph/caps.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 15ba173c07ae..16e13ba9c9ac 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -1630,6 +1630,8 @@ static void __send_cap(struct cap_msg_args *arg, struct ceph_inode_info *ci) spin_lock(&ci->i_ceph_lock); __cap_delay_requeue(arg->session->s_mdsc, ci); spin_unlock(&ci->i_ceph_lock); + ceph_buffer_put(arg->old_xattr_buf); + ceph_buffer_put(arg->xattr_buf); return; } |