ceph: prevent use-after-free in encode_cap_msg()

[linux-2.6-block.git] / fs / ceph / caps.c

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 9c02f328c966cbdd12b8af17d7ddb9d5bb19ea38..e8bf082105d8776c58316b8dbdb99978ccd936e6 100644 (file)
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1452,7 +1452,7 @@ static void __prep_cap(struct cap_msg_args *arg, struct ceph_cap *cap,
        if (flushing & CEPH_CAP_XATTR_EXCL) {
                arg->old_xattr_buf = __ceph_build_xattrs_blob(ci);
                arg->xattr_version = ci->i_xattrs.version;
-               arg->xattr_buf = ci->i_xattrs.blob;
+               arg->xattr_buf = ceph_buffer_get(ci->i_xattrs.blob);
        } else {
                arg->xattr_buf = NULL;
                arg->old_xattr_buf = NULL;
@@ -1553,6 +1553,7 @@ static void __send_cap(struct cap_msg_args *arg, struct ceph_inode_info *ci)
        encode_cap_msg(msg, arg);
        ceph_con_send(&arg->session->s_con, msg);
        ceph_buffer_put(arg->old_xattr_buf);
+       ceph_buffer_put(arg->xattr_buf);
        if (arg->wake)
                wake_up_all(&ci->i_cap_wq);
 }