Rishabh Dave 8180d0c27b
ceph: prevent use-after-free in encode_cap_msg() ...
commit cda4672da1c26835dcbd7aec2bfed954eda9b5ef upstream.
In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was
caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This
implies before the refcount could be increment here, it was freed.
In same file, in "handle_cap_grant()" refcount is decremented by this
line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race
occurred and resource was freed by the latter line before the former
line could increment it.
encode_cap_msg() is called by __send_cap() and __send_cap() is called by
ceph_check_caps() after calling __prep_cap(). __prep_cap() is where
arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where
the refcount must be increased to prevent "use after free" error.
Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/59259
Signed-off-by: Rishabh Dave <ridave@redhat.com >
Reviewed-by: Jeff Layton <jlayton@kernel.org >
Reviewed-by: Xiubo Li <xiubli@redhat.com >
Signed-off-by: Ilya Dryomov <idryomov@gmail.com >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2024-02-23 08:42:29 +01:00
2022-06-22 14:13:12 +02:00
2020-10-24 12:26:05 -07:00
2023-02-01 08:23:11 +01:00
2024-02-23 08:42:04 +01:00
2023-09-23 11:01:04 +02:00
2020-09-18 16:45:50 -04:00
2021-01-06 14:56:52 +01:00
2024-02-23 08:42:23 +01:00
2021-03-30 14:32:07 +02:00
2024-02-23 08:42:29 +01:00
2024-02-23 08:41:55 +01:00
2023-03-11 16:39:51 +01:00
2023-09-21 09:45:15 +02:00
2020-09-18 16:45:50 -04:00
2022-11-10 18:14:25 +01:00
2024-01-25 14:37:36 -08:00
2022-02-01 17:25:39 +01:00
2023-09-19 12:20:22 +02:00
2024-02-23 08:42:05 +01:00
2024-01-25 14:37:40 -08:00
2020-09-18 16:45:50 -04:00
2023-09-19 12:20:02 +02:00
2023-11-28 16:54:52 +00:00
2023-09-23 11:01:07 +02:00
2024-02-23 08:42:27 +01:00
2024-02-23 08:42:11 +01:00
2022-06-09 10:20:58 +02:00
2021-09-18 13:40:15 +02:00
2023-12-20 15:44:30 +01:00
2024-01-25 14:37:42 -08:00
2023-03-11 16:39:55 +01:00
2023-05-30 12:57:47 +01:00
2021-04-14 08:42:06 +02:00
2020-09-18 16:45:50 -04:00
2023-01-14 10:16:20 +01:00
2022-07-07 17:52:19 +02:00
2021-11-12 14:58:33 +01:00
2024-01-25 14:37:37 -08:00
2023-07-27 08:44:13 +02:00
2024-02-23 08:42:04 +01:00
2024-02-23 08:42:14 +01:00
2023-09-19 12:20:15 +02:00
2022-04-13 21:01:01 +02:00
2024-01-25 14:37:43 -08:00
2020-12-30 11:53:45 +01:00
2023-12-08 08:46:10 +01:00
2024-02-23 08:42:28 +01:00
2023-09-19 12:20:04 +02:00
2023-07-27 08:44:15 +02:00
2022-11-25 17:45:57 +01:00
2023-09-19 12:20:09 +02:00
2020-09-22 23:39:45 -04:00
2023-01-14 10:16:20 +01:00
2023-11-28 16:54:57 +00:00
2023-11-28 16:54:56 +00:00
2024-02-23 08:42:04 +01:00
2021-09-30 10:11:08 +02:00
2020-09-18 16:45:50 -04:00
2023-11-28 16:54:58 +00:00
2023-07-27 08:44:13 +02:00
2023-09-19 12:20:06 +02:00
2020-10-24 12:26:05 -07:00
2023-02-22 12:55:56 +01:00
2020-10-02 12:02:30 +02:00
2023-08-11 11:57:53 +02:00
2023-09-23 11:01:10 +02:00
2024-02-23 08:41:54 +01:00
2023-09-19 12:20:23 +02:00
2020-10-24 12:26:05 -07:00
2020-09-10 14:03:31 -07:00
2021-10-17 10:43:33 +02:00
2023-09-19 12:20:22 +02:00
2023-06-14 11:09:59 +02:00
2023-04-05 11:23:51 +02:00
2023-02-22 12:55:54 +01:00
2023-09-23 11:01:09 +02:00
2020-06-03 23:16:55 -04:00
2023-10-10 21:53:35 +02:00
2022-11-03 23:57:49 +09:00
2020-06-04 19:18:29 -07:00
2022-06-09 10:20:47 +02:00
2023-01-14 10:16:13 +01:00
2020-06-04 19:18:29 -07:00
2024-01-15 18:48:03 +01:00
2022-11-25 17:45:56 +01:00
2023-01-14 10:15:59 +01:00
2020-06-05 13:45:21 -07:00
2023-01-04 11:39:22 +01:00
2020-10-14 14:54:45 -07:00
2022-06-09 10:21:16 +02:00
2024-02-23 08:42:10 +01:00
2021-04-14 08:41:58 +02:00
2023-09-19 12:20:06 +02:00
2023-06-21 15:45:37 +02:00
2024-02-23 08:41:58 +01:00
2022-10-30 09:41:18 +01:00
2022-05-18 10:23:48 +02:00
2023-08-11 11:57:53 +02:00
2023-07-27 08:44:13 +02:00
2020-10-13 18:38:27 -07:00
2020-07-29 16:14:27 +02:00
2023-05-17 11:48:10 +02:00
2020-08-23 17:36:59 -05:00
2020-08-04 21:02:38 -04:00
2023-12-08 08:46:15 +01:00
2023-07-27 08:44:13 +02:00
2024-02-23 08:41:53 +01:00
2021-02-17 11:02:21 +01:00
2020-06-14 01:57:21 +09:00
2021-10-27 09:56:51 +02:00
2023-01-14 10:15:19 +01:00
2023-09-23 11:01:04 +02:00
2023-01-04 11:39:23 +01:00
2023-01-14 10:16:50 +01:00
2020-06-02 10:59:07 -07:00
2024-02-23 08:41:54 +01:00
2024-01-25 14:37:42 -08:00
2023-08-11 11:57:53 +02:00
2024-02-23 08:42:00 +01:00
2023-01-14 10:16:27 +01:00
2021-03-17 17:06:13 +01:00
2020-06-08 11:04:19 -07:00
2020-12-30 11:54:02 +01:00
2022-12-19 12:27:30 +01:00
2021-04-21 13:00:54 +02:00
2022-07-21 21:20:01 +02:00
2022-01-29 10:26:11 +01:00
2021-07-20 16:05:59 +02:00
2022-09-05 10:28:58 +02:00
2022-10-17 17:26:07 +02:00
2022-04-27 13:53:54 +02:00
2023-05-30 12:57:55 +01:00
2023-08-11 11:57:54 +02:00
2022-08-31 17:15:14 +02:00
2022-10-26 13:25:17 +02:00
2020-07-31 08:16:01 +02:00
2023-01-14 10:15:16 +01:00
8180d0c27b