From e51cf76e7275d1bb5ad2d529bb00feade632dadc Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 16:27:04 +0000 Subject: [PATCH] ceph: Fix xattr buffer leak in __send_cap() __prep_cap() takes a reference on the xattr blob via ceph_buffer_get() and also grabs a reference to the old xattr blob returned by __ceph_build_xattrs_blob(). These references are normally dropped in __send_cap() after the cap message has been sent, but when ceph_msg_new() fails, __send_cap() requeues the cap and returns early without dropping them, leaking both buffers on every allocation failure. Release arg->old_xattr_buf and arg->xattr_buf on the ceph_msg_new() failure path before returning. Cc: stable@vger.kernel.org Fixes: 16d68903f56a ("ceph: break up send_cap_msg") Signed-off-by: Wentao Liang Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov --- fs/ceph/caps.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 15ba173c07ae..16e13ba9c9ac 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -1630,6 +1630,8 @@ static void __send_cap(struct cap_msg_args *arg, struct ceph_inode_info *ci) spin_lock(&ci->i_ceph_lock); __cap_delay_requeue(arg->session->s_mdsc, ci); spin_unlock(&ci->i_ceph_lock); + ceph_buffer_put(arg->old_xattr_buf); + ceph_buffer_put(arg->xattr_buf); return; }