[BUG] ceph: WARNING in ceph_con_v1_try_read (process_connect)

[CJ <firefly0158@163.com>]

Hi,


I am reporting an issue triggered by a syzkaller reproducer on Linux
7.3.0-rc2. The issue is reproducible with HEAD commit
df2908090cda368b01ff43709f51890076c56157.


The reproducer creates a listening TCP socket, connects a ceph filesystem to
it through fsconfig(), accepts the connection in the reproducer's own
process, and then writes a crafted banner and handshake reply into that
socket. The reproducer is playing the part of the peer, so it controls the
connect sequence numbers the client sees.


When the client processes the reply, process_connect() compares the connect
sequence it expects against the one in the reply and finds them different.
The WARN_ON for that mismatch fires, in the ceph-msgr workqueue worker
running ceph_con_workfn() -> ceph_con_v1_try_read().


This looks like a protocol-consistency check that is only able to report the
mismatch rather than recover from it. A peer that returns a connect_seq the
client does not expect is external input, so treating the condition as a
connection error and resetting the session would be more useful than a
warning. I have not worked out whether any legitimate reconnection sequence
can also produce this mismatch.


This failure was reported earlier against the linux-6.1 longterm series at
https://syzkaller.appspot.com/bug?extid=2c455222b38ef24a567c, and the
reproducer below is the one from that report. It still reproduces on the
tested mainline kernel.


Reproducer:


syz reproducer:
The reproducer is the program below, which requires no large encoded image:


r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:6789:/\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = accept$inet(r0, 0x0, 0x0)
write(r2, &(0x7f0000000300)='ceph v027\x00'/278, 0x119)
write(r2, &(0x7f0000000800)="01ffffffffffffffff00"/26, 0x1a)


console output: https://pastebin.com/raw/2iihLuZS


kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=872c04466179833f


Kernel:


HEAD commit: df2908090cda368b01ff43709f51890076c56157
git tree: mainline
kernel version: 7.3.0-rc2
tested tag: v7.3-rc2 (annotated tag object 5e036ce12de91c6fd674dad33b169c6150be2a7a)


Let me know if you need more details or testing.


Best regards,
Changjian Liu