linux/fs/ceph
Rishabh Dave f3f98d7d84 ceph: prevent use-after-free in encode_cap_msg()
commit cda4672da1 upstream.

In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was
caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This
implies before the refcount could be increment here, it was freed.

In same file, in "handle_cap_grant()" refcount is decremented by this
line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race
occurred and resource was freed by the latter line before the former
line could increment it.

encode_cap_msg() is called by __send_cap() and __send_cap() is called by
ceph_check_caps() after calling __prep_cap(). __prep_cap() is where
arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where
the refcount must be increased to prevent "use after free" error.

Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/59259
Signed-off-by: Rishabh Dave <ridave@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-02-23 09:12:46 +01:00
..
acl.c vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
addr.c ceph: fix blindly expanding the readahead windows 2023-07-23 13:49:41 +02:00
cache.c mm, netfs, fscache: stop read optimisation when folio removed from pagecache 2024-01-10 17:10:31 +01:00
cache.h netfs: Further cleanups after struct netfs_inode wrapper introduced 2022-06-10 20:55:21 +01:00
caps.c ceph: prevent use-after-free in encode_cap_msg() 2024-02-23 09:12:46 +01:00
ceph_frag.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
debugfs.c ceph: fix potential use-after-free bug when trimming caps 2023-05-11 23:03:05 +09:00
dir.c ceph: wait for the first reply of inflight async unlink 2022-08-03 00:54:12 +02:00
export.c ceph: fail the open_by_handle_at() if the dentry is being unlinked 2022-10-04 19:18:08 +02:00
file.c ceph: fix type promotion bug on 32bit systems 2023-10-19 23:08:57 +02:00
inode.c ceph: fix incorrect revoked caps assert in ceph_fill_file_size() 2023-10-19 23:08:56 +02:00
io.c ceph: fix kerneldoc copypasta over ceph_start_io_direct 2021-04-27 23:52:23 +02:00
io.h ceph: add buffered/direct exclusionary locking for reads and writes 2019-09-16 12:06:25 +02:00
ioctl.c ceph: consider inode's last read/write when calculating wanted caps 2020-03-30 12:42:42 +02:00
ioctl.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig ceph: conversion to new fscache API 2022-01-11 22:13:01 +00:00
locks.c ceph: switch to vfs_inode_has_locks() to fix file lock bug 2023-01-12 12:02:23 +01:00
Makefile ceph: add dentry lease metric support 2020-06-01 13:22:51 +02:00
mds_client.c ceph: reinitialize mds feature bit even when session in open 2024-02-05 20:12:59 +00:00
mds_client.h ceph: drop messages from MDS when unmounting 2023-10-06 14:56:50 +02:00
mdsmap.c treewide: use prandom_u32_max() when possible, part 1 2022-10-11 17:42:55 -06:00
metric.c ceph: never send metrics if disable_send_metrics is set 2023-08-03 10:24:16 +02:00
metric.h ceph: include average/stdev r/w/m latency in mds metrics 2022-03-21 13:35:16 +01:00
quota.c ceph: fix invalid pointer access if get_quota_realm return ERR_PTR 2024-02-05 20:12:59 +00:00
snap.c ceph: drop messages from MDS when unmounting 2023-10-06 14:56:50 +02:00
strings.c ceph: add getvxattr op 2022-03-01 18:26:37 +01:00
super.c ceph: drop messages from MDS when unmounting 2023-10-06 14:56:50 +02:00
super.h ceph: drop messages from MDS when unmounting 2023-10-06 14:56:50 +02:00
util.c ceph: move net/ceph/ceph_fs.c to fs/ceph/util.c 2020-01-27 16:53:40 +01:00
xattr.c ceph: prevent a client from exceeding the MDS maximum xattr size 2022-08-03 00:54:12 +02:00