During the resolution of monitor addresses, the failure to resolve the
server name [1] resulted in no available monitors (i.e., the num_mon
value in ceph_options was 0).
This triggered the issue [2] when joining the Ceph cluster.
Before creating the client, if the number of monitors specified in the
options is invalid, the client creation process is aborted.
[1]
libceph: resolve '127.0.0.' (ret=-3): failed
[2]
kernel BUG at net/ceph/mon_client.c:211!
Call Trace:
ceph_monc_open_session+0x46/0x60 net/ceph/mon_client.c:534
__ceph_open_session+0x135/0x590 net/ceph/ceph_common.c:798
ceph_real_mount fs/ceph/super.c:1173 [inline]
ceph_get_tree+0xd98/0x1fd0 fs/ceph/super.c:1362
Fixes: 16725b9d2a2e ("ceph: super.c")
Reported-by: syzbot+1dbed5969931c19d3eb5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1dbed5969931c19d3eb5
Tested-by: syzbot+1dbed5969931c19d3eb5@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
v1 -> v2: unified email address
fs/ceph/super.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 72935f665f11..0f20d6c5e4bd 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -818,7 +818,11 @@ static struct ceph_fs_client *create_fs_client(struct ceph_mount_options *fsopt,
struct ceph_options *opt)
{
struct ceph_fs_client *fsc;
- int err;
+ int err, num_mon;
+
+ num_mon = opt->num_mon;
+ if (num_mon == 0 || num_mon > CEPH_MAX_MON)
+ return ERR_PTR(-EINVAL);
fsc = kzalloc_obj(*fsc);
if (!fsc) {
--
2.43.0