ceph: avoid invalid memory dereference in the middle of umount

extra_mon_dispatch() and debugfs' foo_show functions dereference
fsc->mdsc. we should clean up fsc->client->extra_mon_dispatch
and debugfs before destroying fsc->mds.

Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 0c05df44cc6c8888d56d32f53d54fba109f8508c..666a9f2748321b8f73b956e876908a2ae7d306be 100644 (file)
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -3769,13 +3769,13 @@ static void ceph_mdsc_stop(struct ceph_mds_client *mdsc)
 void ceph_mdsc_destroy(struct ceph_fs_client *fsc)
 {
        struct ceph_mds_client *mdsc = fsc->mdsc;
-
        dout("mdsc_destroy %p\n", mdsc);
-       ceph_mdsc_stop(mdsc);
 
        /* flush out any connection work with references to us */
        ceph_msgr_flush();
 
+       ceph_mdsc_stop(mdsc);
+
        fsc->mdsc = NULL;
        kfree(mdsc);
        dout("mdsc_destroy %p done\n", mdsc);

diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 8d7918ce694a9c0d980641ab66b7be6d0aaa33a5..14e78dd52ef9c2925a835e0b7e1c9d2a7a51bc99 100644 (file)
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -636,8 +636,6 @@ static void destroy_fs_client(struct ceph_fs_client *fsc)
 
        destroy_mount_options(fsc->mount_options);
 
-       ceph_fs_debugfs_cleanup(fsc);
-
        ceph_destroy_client(fsc->client);
 
        kfree(fsc);
@@ -1040,6 +1038,10 @@ static void ceph_kill_sb(struct super_block *s)
 
        ceph_mdsc_pre_umount(fsc->mdsc);
        generic_shutdown_super(s);
+
+       fsc->client->extra_mon_dispatch = NULL;
+       ceph_fs_debugfs_cleanup(fsc);
+
        ceph_mdsc_destroy(fsc);
 
        destroy_fs_client(fsc);