diff options
| author | Yan, Zheng <zyan@redhat.com> | 2018-06-19 04:39:19 +0200 |
|---|---|---|
| committer | Yan, Zheng <zyan@redhat.com> | 2018-06-19 04:39:19 +0200 |
| commit | d9e91878322107cd0127ffa3cd9af33aa5f240e4 (patch) | |
| tree | c9b432f698e328f810f3ff81f75f86d5b58a9a5f /src/client | |
| parent | Merge pull request #22500 from thinkercui/bugfix (diff) | |
| download | ceph-d9e91878322107cd0127ffa3cd9af33aa5f240e4.tar.xz ceph-d9e91878322107cd0127ffa3cd9af33aa5f240e4.zip | |
client: fix use-after-free in Client::link()
Fixes: http://tracker.ceph.com/issues/24557
Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Diffstat (limited to 'src/client')
| -rw-r--r-- | src/client/Client.cc | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/client/Client.cc b/src/client/Client.cc index 213b78465d4..1b2a209c5cc 100644 --- a/src/client/Client.cc +++ b/src/client/Client.cc @@ -2975,8 +2975,10 @@ Dentry* Client::link(Dir *dir, const string& name, Inode *in, Dentry *dn) } if (in) { // link to inode + InodeRef tmp_ref; // only one parent for directories! if (in->is_dir() && !in->dentries.empty()) { + tmp_ref = in; // prevent unlink below from freeing the inode. Dentry *olddn = in->get_first_parent(); assert(olddn->dir != dir || olddn->name != name); Inode *old_diri = olddn->dir->parent_inode; |