From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f46.google.com (mail-qv1-f46.google.com [209.85.219.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3A4C438FEF for ; Mon, 29 Jun 2026 17:14:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782753287; cv=none; b=RYJ7RneYk+SjzMDNBl3w7KrjbEHqEj5WJuaVqbx2MsKxJTM/O7r1uEmUJVGJ8iUo1A17dlFv+yiBbGTPiWfFPT8LXu+7h7kYukQuWAW0I0Cqs/OsWOvDOlJuwHc/Bph2epJks81tZmwola/EoS35d+lSkio7hBRPss+2q2Jy8UE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782753287; c=relaxed/simple; bh=RYX4k7mEvTZcWvAcRFU1w6p56PcAZ/5Qzzn0lCjvQ4k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=roXnW7XPbV3Q6gim20Da7thsoMYCtn5LlVq8XiPUL/E/bUZavTzimPL1EuXi2HjfVKFzbnBEXFFlelJUzWb/M+O8ommywZdWDCkelOOcoiXJY6QlX2iF/Uc3kHr4eImNhRKRquTfA1uGpMadKKwp95ustD+1zjAhxV3X2YqAUjs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XI8c1tYr; arc=none smtp.client-ip=209.85.219.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XI8c1tYr" Received: by mail-qv1-f46.google.com with SMTP id 6a1803df08f44-8f18d92172aso3480546d6.2 for ; Mon, 29 Jun 2026 10:14:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782753284; x=1783358084; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=f2vDoBVoHJnWHiWlB4yOirQABqM3qP6B9+UR1w6RX/Y=; b=XI8c1tYr5V1jTSWA9M5+G0OWRBDD+8noNeWN/1C/JZWz6TQFDBSGSIucwowbIZOJQn US+bnzgNbuUS5XD5h67lpgCZ4lSKBpcDjuy6a3gWPgaNgrKIG+MtyNYqqOBGZkRQUi05 mbt/KbGnPK62G6SEBN64aD9snz0R8x6Hmg6xueqTl9CSFrL6pdPcTKvbQyxdlZGQHEEy OIjasJAbyCxHCbhnrTr3DS7oTJxhiotnHKzD31qD4F/ls3KV6a5fZHUqkyPTup+9l7ta 4vo5t6ZNv9GdwBB46V/Xk5ZioyuE3fQMQi0HHqaCRuiKoLMq6WZgotAvYUGxFtZJ+lgr UQag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782753284; x=1783358084; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=f2vDoBVoHJnWHiWlB4yOirQABqM3qP6B9+UR1w6RX/Y=; b=m6f6RKiogI6yudiWS6JNwANIqvJiU+QrH6PcAqC5z/XHJEu+CXlOqOTGIRu0Nh5cop +Q0wyMMBg0Cly60j6TIhDtR5bvYeHqjL/QuQHh6Y5s7sianQHEVCUxW1Z3U4cBNu6zpA MhA1g/0w8/UvrPLllsn+hK/zml3/9wcPlgnFbN4jMwnC/5kLvd7HYIH/Z3rko8Y/CaN4 uYfigpDHEMSIaK4E3cEPY0HxfrqLOHdZ5fVIE6+1ZCKVhjR/jxpg6uHOsjZxmTnrdBLr cAwo5xgtcL9B0KHwMJbAO92jMuVfHEpf35dKR3Jguw4XnpfPvWJ2Z/TqpoGAN+IhcdIP WV/g== X-Forwarded-Encrypted: i=1; AHgh+RoWz1geJRCWUnJ9ed/HSr5KnqKCrnTOX2jKc4rOvJZiVEybF0Llax9NIcpAO0FywSGcMN9TgYTwx4zIBvY=@vger.kernel.org X-Gm-Message-State: AOJu0Ywfv4jz/Qnk8GM2wn1j70MWcNSKXrvgFocf8qH6/lHv5gbYxMwX 3Ky/kbPFacCcJ9zJwxJOg4ZI7iOZ0UYZEfT18hMfd8p+ZVgLvnFotmet X-Gm-Gg: AfdE7clvU2NHadfHj2ZnXW4zuDqnNXte+jqJ3yDCNc4Vb2l304OHdunNqL2A7WqvRMO XdZMbbLEH0gknUHY1Fc/OU1C1R5ilOjL9tal+3FsmTV0SUm+6oz+AenURd0ba8NY26tqtBgLMJ7 5sCgEpCa33uFiwRAWSFFQbnFV1R/2yoPm5WQ6XS8SwRkw7CQ5eNngMpswbKSWdQhsiEelH/eo27 5BuU3D6R1BXfW4hBc2nzwvbVnXQkxezDxp2NTMgf3YjX8vpdmJ/qxLr3ralmZWe76fPtK/ur9a6 02HJTdRHcsCYdwaeCXgWE1OpDCEOLqa8eXTFn5fgMee6sI1bA0B0hkg11Ib8NQrZoS+sUkoT2hH iH06bUCu5mBZCli+w27Q9LYkaEdYYUIC4+YZ96ieoEVWAto1EseIushiMMl2V5rroL7pfhDVF6w zul1wa/deusp1IoBegBaXcz548miuxo6VFld6wJyPJMw== X-Received: by 2002:a05:6214:3f90:b0:8f0:2653:4a9b with SMTP id 6a1803df08f44-8f1bbcd3629mr2478966d6.39.1782753283906; Mon, 29 Jun 2026 10:14:43 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8f1a6f8d6a8sm2873216d6.35.2026.06.29.10.14.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 29 Jun 2026 10:14:43 -0700 (PDT) From: Shuangpeng Bai To: Ilya Dryomov , Alex Markuze , Viacheslav Dubeyko Cc: Sage Weil , Alex Elder , ceph-devel@vger.kernel.org, linux-kernel@vger.kernel.org, Shuangpeng Bai Subject: [PATCH] libceph: refresh CephX authorizer buffer after update Date: Mon, 29 Jun 2026 13:14:22 -0400 Message-ID: <20260629171422.4163904-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. These cached values are then used by the messenger connect code when sending the authorizer. ceph_x_update_authorizer() can rebuild the authorizer when a newer service ticket is available. If the rebuilt authorizer no longer fits in the existing buffer, ceph_x_build_authorizer() drops its reference to au->buf and allocates a new one. If this is the final reference, ceph_buffer_put() frees the old ceph_buffer and its vec.iov_base, but auth->authorizer_buf still points at that freed memory. A subsequent msgr1 reconnect can therefore queue the stale pointer and trigger a KASAN slab-use-after-free in _copy_from_iter() while tcp_sendmsg() copies the authorizer. Refresh auth->authorizer_buf and auth->authorizer_buf_len after a successful authorizer rebuild so the messenger sends the current buffer. Fixes: 0bed9b5c523d ("libceph: add update_authorizer auth method") Closes: https://lore.kernel.org/all/E378850E-106C-427B-A241-970EB2D054D7@gmail.com/ Signed-off-by: Shuangpeng Bai --- net/ceph/auth_x.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c index 9e64e82d0b63..50a79e8aa656 100644 --- a/net/ceph/auth_x.c +++ b/net/ceph/auth_x.c @@ -849,9 +849,16 @@ static int ceph_x_update_authorizer( au = (struct ceph_x_authorizer *)auth->authorizer; if (au->secret_id < th->secret_id) { + int ret; + dout("ceph_x_update_authorizer service %u secret %llu < %llu\n", au->service, au->secret_id, th->secret_id); - return ceph_x_build_authorizer(ac, th, au); + ret = ceph_x_build_authorizer(ac, th, au); + if (ret) + return ret; + + auth->authorizer_buf = au->buf->vec.iov_base; + auth->authorizer_buf_len = au->buf->vec.iov_len; } return 0; } -- 2.43.0