From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f48.google.com (mail-ej1-f48.google.com [209.85.218.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E89F2AD35 for ; Mon, 24 Aug 2026 16:47:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590038; cv=none; b=rJlxRVBkI6ZIDLP/8x0ucSWC029KL7sfcEVwepTk6X/1P8oOQESKU4dR+i6Dl2+dMhOsxtkAoE1H+VZPJ0B/nMAUqNdFpIbVV3yUi/GmwVgH428kT7XI4RUQW0VXaQd/awjjtWn65nov5duDyD4V4dvZTfeDspszS0mQig02ZwM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787590038; c=relaxed/simple; bh=7Eq4H0wXoehn29ByqTM1IIhuFt1x/zpEaGrgoOhjmr4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gSUjnvCaK4M0xES+EU37/y4GxoOZ197jMJ6FUW2bfoaXIrl+5MWktjLcCJ5pgi06uesyd7kcvPo/3IBkA4XmARg240qtZSXdjjgAVO5+wfhw/Uww15nZ1f5v0uN2tTCdZRzGkMCDQ6bGAVMg/tW6xjWEdzVUKH34b7G/nIW1Mo0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=ionos.com; spf=pass smtp.mailfrom=ionos.com; dkim=pass (2048-bit key) header.d=ionos.com header.i=@ionos.com header.b=hYW/U47M; arc=none smtp.client-ip=209.85.218.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=ionos.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ionos.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ionos.com header.i=@ionos.com header.b="hYW/U47M" Received: by mail-ej1-f48.google.com with SMTP id a640c23a62f3a-c167aa9500dso563070866b.3 for ; Mon, 24 Aug 2026 09:47:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ionos.com; s=google; t=1787590034; x=1788194834; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=vO5J9Tkq/BMJEuFay0EK1J+ldjBV3PGyGhM7DZqzQJk=; b=hYW/U47MZ2bB/sKuhjws8Yo7b8deYavWr5WZxbl5T7zBVXLJfZ3mKRLK1TL5csNgzh xln469FsDbJvRm9cHKtC2AYE2E/4rfn3bptbhdTtTgmetXwh2+iBgWIPusUme7KihDb6 D+nxO5+ZYWTDft6VhbYVnvyQRrGUShjWWOQ9KwpPU46PD2o1rG09UzM7KZ3apenyE9+D C36TvxkrNKTFoUsbFUKuYmb/ew2x0NqWYDgPnQCuscXC4FbPqlg9Gpv3d53JU7+rZPfY MW6k6YAFJSQezeg+KS3obtjCeZkpuKHgvF/OW2IS4iR01nuEUQMcPpxlyMeOPPwgWqSj vm8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787590034; x=1788194834; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vO5J9Tkq/BMJEuFay0EK1J+ldjBV3PGyGhM7DZqzQJk=; b=UNTODeeuKMtk4JoG1VvTr5WFq1lgo1AsMn8TcOO+54aezXbosJ9SuPmoqXHpNRIrwG 3fOxhW6phym1ik/8SKsxSdUIVONQ9AdOvGk14jPBlb4y4q+3UDR/MoC01Q46zFzzbiIh q7pVcvery3yyoOTdv8BTE9drRynE9iSLlNjLlD+sxs6sbEQdNrjmUZTWX7dmghp56agA dWLts+DPMkMV17r+z5O+7wwdrjE8PU8EF6QStmCG/L0544qAr551Ik/dz/7Wo2dxFjxv 5BQf5aqp4BeP4d9nlNuR/V271NaMhhrovkdNOGvUm1GaHzghvl57mSAt1SwgCNBtAj+b OgjQ== X-Forwarded-Encrypted: i=1; AHgh+Rq192xxiWLmW5ZT7iT0d3fAETXtGPAZYMSeylamVnBZzAUDm+i7u1fJVK17JqSx3VYOdLYzgBjE11S0xac=@vger.kernel.org X-Gm-Message-State: AFuF++lQ3d6/aZNA4ujlKZtnSY0Yz5H9Sh+hURoNp7mqQLavvPImXleQ /IqnmWYjyHRpkj1VcInYjjXORbWVk4GOf/ksC4xVpjodMYW/nocuc37W27Dgn5Hl8Gqwa+IbFrY 6OYjmSzc= X-Gm-Gg: AR+sD12Rmdj0X9rKfNIz8puFAnvv7CRwF3NLwBDA9dhKFWm0cSCV6Y4hvdBW1F+QP/p RslumBBWlM402m64zq1oKI2FFph43DwOd7cciJ+5kkEwMIkGAQJ2JhBKzv0uSAXMD0X9e6abqRu m/UH3tlbHifCt1xQVRVTPHBs7p/D4jvNkoS5wQhcNTcz6Wj9VvYlVVriceUrE/1ps/+U44+48Gz QAJqDfGAw7PgEr6bRB1OibAUEHfU+UFPmozG4ZEaYkE4lqbc1tOMixqk3TbrlSZ3CwUF1wk2urR l/ZYeJzbp0kVb3WtbBbgQYjaWTs2fbPQh5m0KP6e09lQcN/a9atL1+aCL32Z6jIjD0jieegjEwX X2CKgsbxCCeZ/EDMSGD5FHC2WWytPy+C5xG4ojovUYeqwjaojezahX/CRKaPTtCDBSvnsGAWyGA LuYn29SPSUu5ff1htJLnunz+d8ssnMsDiy1n6HERtwliEi7UEkin19dVZU1Tv/zhsamIMFOAYhz EkFElS9x5p73r6YGQUQWLzk/lgD8mA9K+PnuzkMljn+fDcWmHZzYss/L8GA8CAK X-Received: by 2002:a17:907:fd18:b0:c24:d48a:e1e0 with SMTP id a640c23a62f3a-c24d48ae5c7mr623299266b.14.1787590032837; Mon, 24 Aug 2026 09:47:12 -0700 (PDT) Received: from raven.intern.cm-ag (p200300dc6f02b200023064fffe740809.dip0.t-ipconnect.de. [2003:dc:6f02:b200:230:64ff:fe74:809]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6a59e0190d3sm9209420a12.9.2026.08.24.09.47.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Aug 2026 09:47:12 -0700 (PDT) From: Max Kellermann To: idryomov@gmail.com, amarkuze@redhat.com, xiubo.li@clyso.com, ceph-devel@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Max Kellermann , stable@vger.kernel.org Subject: [PATCH] ceph: lock mutex in ceph_mds_check_access() Date: Mon, 24 Aug 2026 18:47:07 +0200 Message-ID: <20260824164707.225547-1-max.kellermann@ionos.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex, freeing the previous array and its strings. ceph_mds_check_access() traverses this array without holding the mutex. A concurrent session reopen can therefore free the array while it is being inspected, resulting in a use-after-free like this: Unable to handle kernel paging request at virtual address 003aaad64b2c8bb9 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 56 UID: 2953037534 PID: 1253231 Comm: php-cgi8.4 Not tainted 6.18.45-i2-ampere #1146 NONE [..] pc : ceph_mds_check_access+0xd4/0x550 lr : ceph_mds_check_access+0xc8/0x550 [...] Call trace: ceph_mds_check_access+0xd4/0x550 (P) ceph_atomic_open+0x138/0xbe8 path_openat+0xa24/0xfa8 do_filp_open+0x94/0x158 do_sys_openat2+0x88/0xf8 Fixes: 596afb0b8933 ("ceph: add ceph_mds_check_access() helper") Cc: stable@vger.kernel.org Signed-off-by: Max Kellermann --- fs/ceph/mds_client.c | 4 ++++ fs/ceph/mds_client.h | 1 + 2 files changed, 5 insertions(+) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 3c692ad02c85..0348e8b848ff 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -6532,11 +6532,13 @@ int ceph_mds_check_access(struct ceph_mds_client *mdsc, char *tpath, int mask) doutc(cl, "tpath '%s', mask %d, caller_uid %d, caller_gid %d\n", tpath, mask, caller_uid, caller_gid); + mutex_lock(&mdsc->mutex); for (i = 0; i < mdsc->s_cap_auths_num; i++) { struct ceph_mds_cap_auth *s = &mdsc->s_cap_auths[i]; err = ceph_mds_auth_match(mdsc, s, cred, tpath); if (err < 0) { + mutex_unlock(&mdsc->mutex); put_cred(cred); return err; } else if (err > 0) { @@ -6558,6 +6560,7 @@ int ceph_mds_check_access(struct ceph_mds_client *mdsc, char *tpath, int mask) doutc(cl, "root_squash_perms %d, rw_perms_s %p\n", root_squash_perms, rw_perms_s); if (root_squash_perms && rw_perms_s == NULL) { + mutex_unlock(&mdsc->mutex); doutc(cl, "access allowed\n"); return 0; } @@ -6572,6 +6575,7 @@ int ceph_mds_check_access(struct ceph_mds_client *mdsc, char *tpath, int mask) !!(mask & MAY_READ), !!(mask & MAY_WRITE)); } doutc(cl, "access denied\n"); + mutex_unlock(&mdsc->mutex); return -EACCES; } diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h index 0ece4c9e3529..8774c7d7d18d 100644 --- a/fs/ceph/mds_client.h +++ b/fs/ceph/mds_client.h @@ -603,6 +603,7 @@ struct ceph_mds_client { struct rw_semaphore pool_perm_rwsem; struct rb_root pool_perm_tree; + /* protected by mutex */ u32 s_cap_auths_num; struct ceph_mds_cap_auth *s_cap_auths; -- 2.47.3