shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 03:15:31 +09:00
Code Issues Packages Projects Releases Wiki Activity

ceph: prevent use-after-free in encode_cap_msg()

Browse Source 
commit cda4672da1c26835dcbd7aec2bfed954eda9b5ef upstream.

In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was
caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This
implies before the refcount could be increment here, it was freed.

In same file, in "handle_cap_grant()" refcount is decremented by this
line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race
occurred and resource was freed by the latter line before the former
line could increment it.

encode_cap_msg() is called by __send_cap() and __send_cap() is called by
ceph_check_caps() after calling __prep_cap(). __prep_cap() is where
arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where
the refcount must be increased to prevent "use after free" error.

Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/59259
Signed-off-by: Rishabh Dave <ridave@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Rishabh Dave
2024-02-01 17:07:16 +05:30
committed by Greg Kroah-Hartman
parent 309ef7de5d
commit f3f98d7d84
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
fs/ceph/caps.c
View File

@@ -1391,7 +1391,7 @@ static void __prep_cap(struct cap_msg_args *arg, struct ceph_cap *cap,
if (flushing & CEPH_CAP_XATTR_EXCL) { if (flushing & CEPH_CAP_XATTR_EXCL) {
arg->old_xattr_buf = __ceph_build_xattrs_blob(ci); arg->old_xattr_buf = __ceph_build_xattrs_blob(ci);
arg->xattr_version = ci->i_xattrs.version; arg->xattr_version = ci->i_xattrs.version;
arg->xattr_buf = ci->i_xattrs.blob; arg->xattr_buf = ceph_buffer_get(ci->i_xattrs.blob);
} else { } else {
arg->xattr_buf = NULL; arg->xattr_buf = NULL;
arg->old_xattr_buf = NULL; arg->old_xattr_buf = NULL;
@@ -1457,6 +1457,7 @@ static void __send_cap(struct cap_msg_args *arg, struct ceph_inode_info *ci)
encode_cap_msg(msg, arg); encode_cap_msg(msg, arg);
ceph_con_send(&arg->session->s_con, msg); ceph_con_send(&arg->session->s_con, msg);
ceph_buffer_put(arg->old_xattr_buf); ceph_buffer_put(arg->old_xattr_buf);
ceph_buffer_put(arg->xattr_buf);
if (arg->wake) if (arg->wake)
wake_up_all(&ci->i_cap_wq); wake_up_all(&ci->i_cap_wq);
} }