mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* [PATCH] fs/ceph/mds_client: give up on paths longer than PATH_MAX
@ 2024-11-18 22:28 Max Kellermann
  2024-11-19 12:38 ` Ilya Dryomov
  0 siblings, 1 reply; 18+ messages in thread
From: Max Kellermann @ 2024-11-18 22:28 UTC (permalink / raw)
  To: xiubli, idryomov, ceph-devel, linux-kernel, dario; +Cc: stable, Max Kellermann

If the full path to be built by ceph_mdsc_build_path() happens to be
longer than PATH_MAX, then this function will enter an endless (retry)
loop, effectively blocking the whole task.  Most of the machine
becomes unusable, making this a very simple and effective DoS
vulnerability.

I cannot imagine why this retry was ever implemented, but it seems
rather useless and harmful to me.  Let's remove it and fail with
ENAMETOOLONG instead.

Cc: stable@vger.kernel.org
Reported-by: Dario Weißer <dario@cure53.de>
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
---
 fs/ceph/mds_client.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index c4a5fd94bbbb..4f6ac015edcd 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2808,12 +2808,11 @@ char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc, struct dentry *dentry,
 
 	if (pos < 0) {
 		/*
-		 * A rename didn't occur, but somehow we didn't end up where
-		 * we thought we would. Throw a warning and try again.
+		 * The path is longer than PATH_MAX and this function
+		 * cannot ever succeed.  Creating paths that long is
+		 * possible with Ceph, but Linux cannot use them.
 		 */
-		pr_warn_client(cl, "did not end path lookup where expected (pos = %d)\n",
-			       pos);
-		goto retry;
+		return ERR_PTR(-ENAMETOOLONG);
 	}
 
 	*pbase = base;
-- 
2.45.2


^ permalink raw reply	[flat|nested] 18+ messages in thread

end of thread, other threads:[~2024-12-10  8:42 UTC | newest]

Thread overview: 18+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-11-18 22:28 [PATCH] fs/ceph/mds_client: give up on paths longer than PATH_MAX Max Kellermann
2024-11-19 12:38 ` Ilya Dryomov
2024-11-19 12:51   ` Jeff Layton
2024-11-19 13:02     ` Max Kellermann
2024-11-19 13:32       ` Jeff Layton
2024-11-19 13:58       ` Patrick Donnelly
2024-11-19 14:54         ` Max Kellermann
2024-11-19 15:13           ` Patrick Donnelly
2024-11-21 10:48             ` Alex Markuze
2024-11-25 13:23               ` Alex Markuze
2024-11-25 13:59                 ` Max Kellermann
2024-11-25 14:32                   ` Alex Markuze
2024-12-03 12:20                     ` Max Kellermann
2024-12-04 12:51                       ` Alex Markuze
2024-12-04 13:05                         ` Max Kellermann
2024-12-05  8:24                         ` Max Kellermann
2024-12-08 10:16                           ` Alex Markuze
2024-12-10  8:42                             ` Ilya Dryomov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®