Commit cdbc9836 authored Jul 03, 2025 by Ilya Dryomov

libceph: fix invalid accesses to ceph_connection_v1_info



There is a place where generic code in messenger.c is reading and
another place where it is writing to con->v1 union member without
checking that the union member is active (i.e. msgr1 is in use).

On 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter,
so such a read is almost guaranteed to return a bogus value instead of
0 when msgr2 is in use.  This ends up being fairly benign because the
side effect is just the invalidation of the authorizer and successive
fetching of new tickets.

con->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that
it's being written to can cause more serious consequences, but luckily
it's not something that happens often.

Cc: stable@vger.kernel.org
Fixes: cd1a677c ("libceph, ceph: implement msgr2.1 protocol (crc and secure modes)")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>

parent 249e0a47

net/ceph/messenger.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -1524,7 +1524,7 @@ static void con_fault_finish(struct ceph_connection *con)
		* in case we faulted due to authentication, invalidate our
		* current tickets so that we can get new ones.
		*/
		if (con->v1.auth_retry) {
		if (!ceph_msgr2(from_msgr(con->msgr)) && con->v1.auth_retry) {
		dout("auth_retry %d, invalidating\n", con->v1.auth_retry);
		if (con->ops->invalidate_authorizer)
		con->ops->invalidate_authorizer(con);
		@@ -1714,8 +1714,9 @@ static void clear_standby(struct ceph_connection *con)
		{
		/* come back from STANDBY? */
		if (con->state == CEPH_CON_S_STANDBY) {
		dout("clear_standby %p and ++connect_seq\n", con);
		dout("clear_standby %p\n", con);
		con->state = CEPH_CON_S_PREOPEN;
		if (!ceph_msgr2(from_msgr(con->msgr)))
		con->v1.connect_seq++;
		WARN_ON(ceph_con_flag_test(con, CEPH_CON_F_WRITE_PENDING));
		WARN_ON(ceph_con_flag_test(con, CEPH_CON_F_KEEPALIVE_PENDING));