Commit e1afacb6 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'ceph-for-6.18-rc8' of https://github.com/ceph/ceph-client 

Pull ceph fixes from Ilya Dryomov:
 "A patch to make sparse read handling work in msgr2 secure mode from
  Slava and a couple of fixes from Ziming and myself to avoid operating
  on potentially invalid memory, all marked for stable"

* tag 'ceph-for-6.18-rc8' of https://github.com/ceph/ceph-client:
  libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
  libceph: replace BUG_ON with bounds check for map->max_osd
  ceph: fix crash in process_v2_sparse_read() for encrypted directories
  libceph: drop started parameter of __ceph_open_session()
  libceph: fix potential use-after-free in have_mon_and_osd_map()
parents 1f5e808a 7fce830e

fs/ceph/super.c

+1 −1
Original line number Diff line number Diff line
@@ -1149,7 +1149,7 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc, 
		const char *path = fsc->mount_options->server_path ?

				     fsc->mount_options->server_path + 1 : "";



		err = __ceph_open_session(fsc->client, started);

		err = __ceph_open_session(fsc->client);

		if (err < 0)

			goto out;

include/linux/ceph/libceph.h

+1 −2
Original line number Diff line number Diff line
@@ -306,8 +306,7 @@ struct ceph_entity_addr *ceph_client_addr(struct ceph_client *client); 
u64 ceph_client_gid(struct ceph_client *client);

extern void ceph_destroy_client(struct ceph_client *client);

extern void ceph_reset_client_addr(struct ceph_client *client);

extern int __ceph_open_session(struct ceph_client *client,

			       unsigned long started);

extern int __ceph_open_session(struct ceph_client *client);

extern int ceph_open_session(struct ceph_client *client);

int ceph_wait_for_latest_osdmap(struct ceph_client *client,

				unsigned long timeout);

net/ceph/auth_x.c

+2 −0
Original line number Diff line number Diff line
@@ -631,6 +631,7 @@ static int handle_auth_session_key(struct ceph_auth_client *ac, u64 global_id, 


	/* connection secret */

	ceph_decode_32_safe(p, end, len, e_inval);

	ceph_decode_need(p, end, len, e_inval);

	dout("%s connection secret blob len %d\n", __func__, len);

	if (len > 0) {

		dp = *p + ceph_x_encrypt_offset();
@@ -648,6 +649,7 @@ static int handle_auth_session_key(struct ceph_auth_client *ac, u64 global_id, 


	/* service tickets */

	ceph_decode_32_safe(p, end, len, e_inval);

	ceph_decode_need(p, end, len, e_inval);

	dout("%s service tickets blob len %d\n", __func__, len);

	if (len > 0) {

		ret = ceph_x_proc_ticket_reply(ac, &th->session_key,

net/ceph/ceph_common.c

+34 −24
Original line number Diff line number Diff line
@@ -785,42 +785,53 @@ void ceph_reset_client_addr(struct ceph_client *client) 
}

EXPORT_SYMBOL(ceph_reset_client_addr);



/*

 * true if we have the mon map (and have thus joined the cluster)

 */

static bool have_mon_and_osd_map(struct ceph_client *client)

{

	return client->monc.monmap && client->monc.monmap->epoch &&

	       client->osdc.osdmap && client->osdc.osdmap->epoch;

}



/*

 * mount: join the ceph cluster, and open root directory.

 */

int __ceph_open_session(struct ceph_client *client, unsigned long started)

int __ceph_open_session(struct ceph_client *client)

{

	unsigned long timeout = client->options->mount_timeout;

	long err;

	DEFINE_WAIT_FUNC(wait, woken_wake_function);

	long timeout = ceph_timeout_jiffies(client->options->mount_timeout);

	bool have_monmap, have_osdmap;

	int err;



	/* open session, and wait for mon and osd maps */

	err = ceph_monc_open_session(&client->monc);

	if (err < 0)

		return err;



	while (!have_mon_and_osd_map(client)) {

		if (timeout && time_after_eq(jiffies, started + timeout))

			return -ETIMEDOUT;

	add_wait_queue(&client->auth_wq, &wait);

	for (;;) {

		mutex_lock(&client->monc.mutex);

		err = client->auth_err;

		have_monmap = client->monc.monmap && client->monc.monmap->epoch;

		mutex_unlock(&client->monc.mutex);



		down_read(&client->osdc.lock);

		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;

		up_read(&client->osdc.lock);



		if (err || (have_monmap && have_osdmap))

			break;



		if (signal_pending(current)) {

			err = -ERESTARTSYS;

			break;

		}



		if (!timeout) {

			err = -ETIMEDOUT;

			break;

		}



		/* wait */

		dout("mount waiting for mon_map\n");

		err = wait_event_interruptible_timeout(client->auth_wq,

			have_mon_and_osd_map(client) || (client->auth_err < 0),

			ceph_timeout_jiffies(timeout));

		if (err < 0)

			return err;

		if (client->auth_err < 0)

			return client->auth_err;

		timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);

	}

	remove_wait_queue(&client->auth_wq, &wait);



	if (err)

		return err;



	pr_info("client%llu fsid %pU\n", ceph_client_gid(client),

		&client->fsid);
@@ -833,12 +844,11 @@ EXPORT_SYMBOL(__ceph_open_session); 
int ceph_open_session(struct ceph_client *client)

{

	int ret;

	unsigned long started = jiffies;  /* note the start time */



	dout("open_session start\n");

	mutex_lock(&client->mount_mutex);



	ret = __ceph_open_session(client, started);

	ret = __ceph_open_session(client);



	mutex_unlock(&client->mount_mutex);

	return ret;

net/ceph/debugfs.c

+10 −4
Original line number Diff line number Diff line
@@ -36,8 +36,9 @@ static int monmap_show(struct seq_file *s, void *p) 
	int i;

	struct ceph_client *client = s->private;



	mutex_lock(&client->monc.mutex);

	if (client->monc.monmap == NULL)

		return 0;

		goto out_unlock;



	seq_printf(s, "epoch %d\n", client->monc.monmap->epoch);

	for (i = 0; i < client->monc.monmap->num_mon; i++) {
@@ -48,6 +49,9 @@ static int monmap_show(struct seq_file *s, void *p) 
			   ENTITY_NAME(inst->name),

			   ceph_pr_addr(&inst->addr));

	}



out_unlock:

	mutex_unlock(&client->monc.mutex);

	return 0;

}
@@ -56,13 +60,14 @@ static int osdmap_show(struct seq_file *s, void *p) 
	int i;

	struct ceph_client *client = s->private;

	struct ceph_osd_client *osdc = &client->osdc;

	struct ceph_osdmap *map = osdc->osdmap;

	struct ceph_osdmap *map;

	struct rb_node *n;



	down_read(&osdc->lock);

	map = osdc->osdmap;

	if (map == NULL)

		return 0;

		goto out_unlock;



	down_read(&osdc->lock);

	seq_printf(s, "epoch %u barrier %u flags 0x%x\n", map->epoch,

			osdc->epoch_barrier, map->flags);
@@ -131,6 +136,7 @@ static int osdmap_show(struct seq_file *s, void *p) 
		seq_printf(s, "]\n");

	}



out_unlock:

	up_read(&osdc->lock);

	return 0;

}