Rishabh Dave b8c675dea5 ceph: prevent use-after-free in encode_cap_msg() ... commit cda4672da1c26835dcbd7aec2bfed954eda9b5ef upstream. In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies before the refcount could be increment here, it was freed. In same file, in "handle_cap_grant()" refcount is decremented by this line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race occurred and resource was freed by the latter line before the former line could increment it. encode_cap_msg() is called by __send_cap() and __send_cap() is called by ceph_check_caps() after calling __prep_cap(). __prep_cap() is where arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where the refcount must be increased to prevent "use after free" error. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/59259 Signed-off-by: Rishabh Dave <ridave@redhat.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Xiubo Li <xiubli@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-11-18 12:13:33 +01:00
..
acl.c
addr.c
cache.c
cache.h
caps.c	ceph: prevent use-after-free in encode_cap_msg()	2024-11-18 12:13:33 +01:00
ceph_frag.c
debugfs.c
dir.c
export.c
file.c
inode.c
io.c
io.h
ioctl.c
ioctl.h
Kconfig
locks.c
Makefile
mds_client.c
mds_client.h
mdsmap.c
metric.c
metric.h
quota.c
snap.c
strings.c
super.c
super.h
util.c
xattr.c