[SRU][F][PATCH 1/1] ceph: prevent use-after-free in encode_cap_msg()

[Massimiliano Pellizzer]

From: Rishabh Dave <ridave at redhat.com>

In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was
caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This
implies before the refcount could be increment here, it was freed.

In same file, in "handle_cap_grant()" refcount is decremented by this
line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race
occurred and resource was freed by the latter line before the former
line could increment it.

encode_cap_msg() is called by __send_cap() and __send_cap() is called by
ceph_check_caps() after calling __prep_cap(). __prep_cap() is where
arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where
the refcount must be increased to prevent "use after free" error.

Cc: stable at vger.kernel.org
Link: https://tracker.ceph.com/issues/59259
Signed-off-by: Rishabh Dave <ridave at redhat.com>
Reviewed-by: Jeff Layton <jlayton at kernel.org>
Reviewed-by: Xiubo Li <xiubli at redhat.com>
Signed-off-by: Ilya Dryomov <idryomov at gmail.com>
(backported from commit cda4672da1c26835dcbd7aec2bfed954eda9b5ef)
[mpellizzer: backported adjusting context due to missing commit:
- 0a454bdd501ad ceph: reorganize __send_cap for less spinlock abuse
which split the function __send_cap() in __prep_cap() and __send_cap()]
CVE-2024-26689
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer at canonical.com>
---
 fs/ceph/caps.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 502e52fd2ed28..f944e2bd6e1af 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1347,7 +1347,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap,
 	if (flushing & CEPH_CAP_XATTR_EXCL) {
 		old_blob = __ceph_build_xattrs_blob(ci);
 		arg.xattr_version = ci->i_xattrs.version;
-		arg.xattr_buf = ci->i_xattrs.blob;
+		arg.xattr_buf = ceph_buffer_get(ci->i_xattrs.blob);
 	} else {
 		arg.xattr_buf = NULL;
 	}
@@ -1397,6 +1397,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap,
 		delayed = 1;
 	}
 
+	ceph_buffer_put(arg.xattr_buf);
 	if (wake)
 		wake_up_all(&ci->i_cap_wq);
 
-- 
2.43.0