Ilya Dryomov 9525af1f58 libceph: fix race between delayed_work() and ceph_monc_stop() ... commit 69c7b2fe4c upstream. The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after cancel_delayed_work_sync() runs -- __close_session() doesn't mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in commit b5d91704f5 ("libceph: behave in mon_fault() if cur_mon < 0") and use-after-free can still ensue on monc and objects that hang off of it, with monc->auth and monc->monmap being particularly susceptible to quickly being reused. To fix this: - clear monc->cur_mon and monc->hunting as part of closing the session in ceph_monc_stop() - bail from delayed_work() if monc->cur_mon is cleared, similar to how it's done in mon_fault() and finish_hunting() (based on monc->hunting) - call cancel_delayed_work_sync() after the session is closed Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/66857 Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Xiubo Li <xiubli@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-07-18 13:21:22 +02:00
..
6lowpan
9p	net/9p: fix uninit-value in p9_client_rpc()	2024-06-16 13:47:41 +02:00
802
8021q	net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb	2024-05-17 12:02:07 +02:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:01:50 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:01:48 +01:00
ax25	ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()	2024-06-21 14:38:14 +02:00
batman-adv	batman-adv: Don't accept TT entries for out-of-spec VIDs	2024-07-05 09:34:04 +02:00
bluetooth	bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX	2024-07-11 12:49:12 +02:00
bpf	bpf: Set run context for rawtp test_run callback	2024-06-21 14:38:16 +02:00
bpfilter	net: Use umd_cleanup_helper()	2023-05-31 13:06:57 +02:00
bridge	net: bridge: mst: fix suspicious rcu usage in br_mst_set_state	2024-06-21 14:38:36 +02:00
caif	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
can	net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new	2024-07-05 09:34:01 +02:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-07-18 13:21:22 +02:00
core	net: fix rc7's __skb_datagram_iter()	2024-07-18 13:21:13 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-01 21:07:46 -07:00
dccp	Fix race for duplicate reqsk on identical SYN	2024-07-05 09:33:48 +02:00
devlink	devlink: fix port new reply cmd type	2024-03-26 18:20:11 -04:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:35:41 -08:00
dsa	net: dsa: mark parsed interface mode for legacy switch drivers	2023-08-09 13:08:09 -07:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-02 16:32:46 +02:00
ethtool	ethtool: netlink: do not return SQI value if link is down	2024-07-18 13:21:14 +02:00
handshake	net/handshake: Fix handshake_req_destroy_test1	2024-02-23 09:24:50 +01:00
hsr	hsr: Simplify code for announcing HSR nodes timer setup	2024-05-17 12:02:24 +02:00
ieee802154	sysctl-6.6-rc1	2023-08-29 17:39:15 -07:00
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:42:30 +00:00
ipv4	tcp: avoid too many retransmit packets	2024-07-18 13:21:17 +02:00
ipv6	seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors	2024-06-27 13:49:08 +02:00
iucv	net/iucv: Avoid explicit cpumask var allocation on stack	2024-07-05 09:33:51 +02:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:19:40 -04:00
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-18 12:44:56 -07:00
l2tp	net l2tp: drop flow hash on forward	2024-05-17 12:02:02 +02:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-02-05 20:14:36 +00:00
mac80211	wifi: mac80211: correctly parse Spatial Reuse Parameter Set element	2024-06-21 14:38:13 +02:00
mac802154	mac802154: fix time calculation in ieee802154_configure_durations()	2024-07-11 12:49:10 +02:00
mctp	net: mctp: copy skb ext data when fragmenting	2024-03-26 18:19:34 -04:00
mpls	net: mpls: error out if inner headers are not set	2024-04-13 13:07:41 +02:00
mptcp	mptcp: pm: update add_addr counters after connect	2024-06-21 14:38:38 +02:00
ncsi	net/ncsi: Fix the multi thread manner of NCSI driver	2024-06-21 14:38:14 +02:00
netfilter	netfilter: nf_tables: unconditionally flush pending work before notifier	2024-07-11 12:49:13 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:35:14 -08:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-03-06 14:48:34 +00:00
netrom	netrom: Fix a memory leak in nr_heartbeat_expiry()	2024-06-27 13:49:06 +02:00
nfc	nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()	2024-06-12 11:12:51 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 12:02:02 +02:00
openvswitch	openvswitch: get related ct labels from its master if it is not confirmed	2024-07-05 09:33:46 +02:00
packet	af_packet: avoid a false positive warning in packet_setsockopt()	2024-06-27 13:49:01 +02:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-05-17 12:02:22 +02:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:45:10 +01:00
qrtr	net: qrtr: ns: Fix module refcnt	2024-06-12 11:12:12 +02:00
rds	net/rds: fix possible cp null dereference	2024-04-10 16:35:49 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-01 12:42:41 +00:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-01 12:42:31 +00:00
rxrpc	rxrpc: Only transmit one ACK per jumbo packet received	2024-05-17 12:02:23 +02:00
sched	net/sched: Fix UAF when resolving a clash	2024-07-18 13:21:14 +02:00
sctp	sctp: prefer struct_size over open coded arithmetic	2024-07-11 12:49:06 +02:00
smc	net/smc: avoid overwriting when adjusting sock bufsizes	2024-06-21 14:38:16 +02:00
strparser
sunrpc	net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket	2024-07-18 13:21:14 +02:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-03-01 13:35:06 +01:00
tipc	tipc: force a dst refcount before doing decryption	2024-06-27 13:49:07 +02:00
tls	tls: fix missing memory barrier in tls_init	2024-06-12 11:12:50 +02:00
unix	af_unix: Read with MSG_PEEK loops if the first unread byte is OOB	2024-06-21 14:38:36 +02:00
vmw_vsock	vsock/virtio: fix packet delivery to tap device	2024-04-10 16:35:50 +02:00
wireless	wifi: cfg80211: pmsr: use correct nla_get_uX functions	2024-06-21 14:38:12 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:19:41 -04:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-04-17 11:19:28 +02:00
xfrm	net: fix __dst_negative_advice() race	2024-06-16 13:47:44 +02:00
compat.c
devres.c
Kconfig	bpf: Add fd-based tcx multi-prog infra with link support	2023-07-19 10:07:27 -07:00
Kconfig.debug
Makefile
socket.c	net: Save and restore msg_namelen in sock_sendmsg	2024-01-10 17:16:51 +01:00
sysctl_net.c	sysctl: Add size to register_net_sysctl function	2023-08-15 15:26:17 -07:00