Xiubo Li 2b2515b809 ceph: fix potential use-after-free bug when trimming caps ...

commit aaf67de788 upstream.

When trimming the caps and just after the 'session->s_cap_lock' is
released in ceph_iterate_session_caps() the cap maybe removed by
another thread, and when using the stale cap memory in the callbacks
it will trigger use-after-free crash.

We need to check the existence of the cap just after the 'ci->i_ceph_lock'
being acquired. And do nothing if it's already removed.

Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/43272
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Luís Henriques <lhenriques@suse.de>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-11 23:03:05 +09:00

..

acl.c

vfs: add rcu argument to ->get_acl() callback

2021-08-18 22:08:24 +02:00

addr.c

ceph: blocklist the kclient when receiving corrupted snap trace

2023-02-22 12:59:45 +01:00

cache.c

netfs: Fix gcc-12 warning by embedding vfs inode in netfs_i_context

2022-06-09 13:55:00 -07:00

cache.h

netfs: Further cleanups after struct netfs_inode wrapper introduced

2022-06-10 20:55:21 +01:00

caps.c

ceph: fix potential use-after-free bug when trimming caps

2023-05-11 23:03:05 +09:00

ceph_frag.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

debugfs.c

ceph: fix potential use-after-free bug when trimming caps

2023-05-11 23:03:05 +09:00

dir.c

ceph: wait for the first reply of inflight async unlink

2022-08-03 00:54:12 +02:00

export.c

ceph: fail the open_by_handle_at() if the dentry is being unlinked

2022-10-04 19:18:08 +02:00

file.c

ceph: update the time stamps and try to drop the suid/sgid

2023-03-10 09:34:25 +01:00

inode.c

ceph: fix a NULL vs IS_ERR() check when calling ceph_lookup_inode()

2022-11-14 10:29:05 +01:00

io.c

ceph: fix kerneldoc copypasta over ceph_start_io_direct

2021-04-27 23:52:23 +02:00

io.h

ceph: add buffered/direct exclusionary locking for reads and writes

2019-09-16 12:06:25 +02:00

ioctl.c

ceph: consider inode's last read/write when calculating wanted caps

2020-03-30 12:42:42 +02:00

ioctl.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Kconfig

ceph: conversion to new fscache API

2022-01-11 22:13:01 +00:00

locks.c

ceph: switch to vfs_inode_has_locks() to fix file lock bug

2023-01-12 12:02:23 +01:00

Makefile

ceph: add dentry lease metric support

2020-06-01 13:22:51 +02:00

mds_client.c

ceph: fix potential use-after-free bug when trimming caps

2023-05-11 23:03:05 +09:00

mds_client.h

ceph: fix potential use-after-free bug when trimming caps

2023-05-11 23:03:05 +09:00

mdsmap.c

treewide: use prandom_u32_max() when possible, part 1

2022-10-11 17:42:55 -06:00

metric.c

ceph: include average/stdev r/w/m latency in mds metrics

2022-03-21 13:35:16 +01:00

metric.h

ceph: include average/stdev r/w/m latency in mds metrics

2022-03-21 13:35:16 +01:00

quota.c

ceph: fix statfs for subdir mounts

2022-05-25 20:45:14 +02:00

snap.c

ceph: blocklist the kclient when receiving corrupted snap trace

2023-02-22 12:59:45 +01:00

strings.c

ceph: add getvxattr op

2022-03-01 18:26:37 +01:00

super.c

ceph: make f_bsize always equal to f_frsize

2022-08-03 00:54:13 +02:00

super.h

ceph: fix potential use-after-free bug when trimming caps

2023-05-11 23:03:05 +09:00

util.c

ceph: move net/ceph/ceph_fs.c to fs/ceph/util.c

2020-01-27 16:53:40 +01:00

xattr.c

ceph: prevent a client from exceeding the MDS maximum xattr size

2022-08-03 00:54:12 +02:00