ceph: fix UAF bugs in cap flushing and MDS session handling

[PATCH 0/2] ceph: fix UAF bugs in cap flushing and MDS session handling

Xiubo Li via B4 Relay posted 2 patches 1 week, 4 days ago

Download series mbox

fs/ceph/caps.c       | 11 +++++++++--
fs/ceph/mds_client.c |  6 ++++++
2 files changed, 15 insertions(+), 2 deletions(-)

Expand all Fold all

[PATCH 0/2] ceph: fix UAF bugs in cap flushing and MDS session handling

Posted by Xiubo Li via B4 Relay 1 week, 4 days ago

These two patches fix use-after-free bugs:

Patch 1 fixes __kick_flushing_caps(), which drops i_ceph_lock during
list_for_each_entry() iteration.  A concurrent handle_cap_flush_ack()
can free the current cf entry, making the loop's next-pointer advance
read freed memory.

Patch 2 fixes check_new_map(), where three code paths drop mdsc->mutex
and access the session pointer without taking a reference, opening a
window for another thread to unregister and free the session.

Signed-off-by: Xiubo Li <xiubo.li@clyso.com>
---
Xiubo Li (2):
      ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
      ceph: fix UAF in check_new_map() on session freed during unlock

 fs/ceph/caps.c       | 11 +++++++++--
 fs/ceph/mds_client.c |  6 ++++++
 2 files changed, 15 insertions(+), 2 deletions(-)
---
base-commit: fc67edb66b3c9924c4e0bb366a92b32ea13c526a
change-id: 20260714-ceph-uaf-fixes-bedfe0f2b159

Best regards,
--  
Xiubo Li <xiubo.li@clyso.com>