mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/fs/ceph
History
Rishabh Dave 70e329b440 ceph: prevent use-after-free in encode_cap_msg() 
commit cda4672da1 upstream.

In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was
caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This
implies before the refcount could be increment here, it was freed.

In same file, in "handle_cap_grant()" refcount is decremented by this
line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race
occurred and resource was freed by the latter line before the former
line could increment it.

encode_cap_msg() is called by __send_cap() and __send_cap() is called by
ceph_check_caps() after calling __prep_cap(). __prep_cap() is where
arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where
the refcount must be increased to prevent "use after free" error.

Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/59259
Signed-off-by: Rishabh Dave <ridave@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2024-02-23 08:55:09 +01:00
..
Kconfig
…
Makefile
…
acl.c
…
addr.c ceph: switch netfs read ops to use rreq->inode instead of rreq->mapping->host 2022-07-21 21:24:30 +02:00
cache.c
…
cache.h
…
caps.c ceph: prevent use-after-free in encode_cap_msg() 2024-02-23 08:55:09 +01:00
ceph_frag.c
…
debugfs.c
…
dir.c ceph: fix memory leak in ceph_readdir when note_last_dentry returns error 2022-04-13 20:59:10 +02:00
export.c
…
file.c ceph: fix type promotion bug on 32bit systems 2023-10-19 23:05:36 +02:00
inode.c ceph: fix incorrect revoked caps assert in ceph_fill_file_size() 2023-10-19 23:05:36 +02:00
io.c
…
io.h
…
ioctl.c
…
ioctl.h
…
locks.c ceph: switch to vfs_inode_has_locks() to fix file lock bug 2023-01-12 11:59:14 +01:00
mds_client.c ceph: defer stopping mdsc delayed_work 2023-08-11 15:13:56 +02:00
mds_client.h ceph: defer stopping mdsc delayed_work 2023-08-11 15:13:56 +02:00
mdsmap.c
…
metric.c ceph: never send metrics if disable_send_metrics is set 2023-08-03 10:22:46 +02:00
metric.h
…
quota.c
…
snap.c ceph: fix use-after-free bug for inodes when flushing capsnaps 2023-06-14 11:13:06 +02:00
strings.c
…
super.c ceph: defer stopping mdsc delayed_work 2023-08-11 15:13:56 +02:00
super.h ceph: switch to vfs_inode_has_locks() to fix file lock bug 2023-01-12 11:59:14 +01:00
util.c
…
xattr.c ceph: allow ceph.dir.rctime xattr to be updatable 2022-06-14 18:36:23 +02:00