From: Max Kellermann <max.kellermann@ionos.com> maillist inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18967 CVE: CVE-2026-89654 Reference: https://lore.kernel.org/ceph-devel/20260904150304.49104-2-max.kellermann@ion... -------------------------------- check_new_map() drops mdsc->mutex while it locks a session, prepares a reconnect, or kicks flushing caps. A concurrent teardown can call __unregister_session() in that window and drop the sessions[] reference. When check_new_map() reacquires mdsc->mutex, its temporary reference may therefore be the only reference keeping the local variable `s` alive. Commit ee611a750955 ("ceph: fix UAF in check_new_map() on session freed during unlock") addressed this by taking a temporary reference around each unlock window, but it drops that reference as soon as mdsc->mutex is reacquired, while `s` is still in use: ceph_get_mds_session(s); mutex_unlock(&mdsc->mutex); mutex_lock(&s->s_mutex); mutex_lock(&mdsc->mutex); ceph_put_mds_session(s); /* may drop the last reference */ ceph_con_close(&s->s_con); /* use-after-free */ mutex_unlock(&s->s_mutex); /* use-after-free */ s->s_state = CEPH_MDS_SESSION_RESTARTING; If the session was unregistered during the window, the sessions[] reference is already gone, so this ceph_put_mds_session() frees it. Additionally, the session could be freed while its s_mutex is locked, which trips the WARN_ON(mutex_is_locked(&s->s_mutex)) in ceph_put_mds_session() and then unlocks freed memory. Fix this by holding a single reference for the whole loop iteration: look the session up with __ceph_lookup_mds_session(), which returns it with a reference held, and release that reference on every exit from the loop body. This subsumes the per-window get/put pairs, so remove them. Fixes: ee611a750955 ("ceph: fix UAF in check_new_map() on session freed during unlock") Cc: stable@vger.kernel.org Signed-off-by: Max Kellermann <max.kellermann@ionos.com> Conflicts: fs/ceph/mds_client.c [Only diff-context adjustments: the reconnect path lacks the int return rework of commit 39fe30315893 and the log helpers predate the *_client rework.] Signed-off-by: Chen Yuxi <chenyuxi19@huawei.com> --- fs/ceph/mds_client.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index ebebbfd3fabf..e869891e86bf 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -4844,9 +4844,9 @@ static void check_new_map(struct ceph_mds_client *mdsc, } for (i = 0; i < oldmap->possible_max_rank && i < mdsc->max_sessions; i++) { - if (!mdsc->sessions[i]) + s = __ceph_lookup_mds_session(mdsc, i); + if (!s) continue; - s = mdsc->sessions[i]; oldstate = ceph_mdsmap_get_state(oldmap, i); newstate = ceph_mdsmap_get_state(newmap, i); @@ -4859,7 +4859,6 @@ static void check_new_map(struct ceph_mds_client *mdsc, if (i >= newmap->possible_max_rank) { /* force close session for stopped mds */ - ceph_get_mds_session(s); __unregister_session(mdsc, s); __wake_requests(mdsc, &s->s_waiting); mutex_unlock(&mdsc->mutex); @@ -4880,15 +4879,14 @@ static void check_new_map(struct ceph_mds_client *mdsc, ceph_mdsmap_get_addr(newmap, i), sizeof(struct ceph_entity_addr))) { /* just close it */ - ceph_get_mds_session(s); mutex_unlock(&mdsc->mutex); mutex_lock(&s->s_mutex); mutex_lock(&mdsc->mutex); - ceph_put_mds_session(s); ceph_con_close(&s->s_con); mutex_unlock(&s->s_mutex); s->s_state = CEPH_MDS_SESSION_RESTARTING; } else if (oldstate == newstate) { + ceph_put_mds_session(s); continue; /* nothing new with this mds */ } @@ -4897,12 +4895,10 @@ static void check_new_map(struct ceph_mds_client *mdsc, */ if (s->s_state == CEPH_MDS_SESSION_RESTARTING && newstate >= CEPH_MDS_STATE_RECONNECT) { - ceph_get_mds_session(s); mutex_unlock(&mdsc->mutex); clear_bit(i, targets); send_mds_reconnect(mdsc, s); mutex_lock(&mdsc->mutex); - ceph_put_mds_session(s); } /* @@ -4914,15 +4910,14 @@ static void check_new_map(struct ceph_mds_client *mdsc, oldstate != CEPH_MDS_STATE_STARTING) pr_info("mds%d recovery completed\n", s->s_mds); kick_requests(mdsc, i); - ceph_get_mds_session(s); mutex_unlock(&mdsc->mutex); mutex_lock(&s->s_mutex); mutex_lock(&mdsc->mutex); - ceph_put_mds_session(s); ceph_kick_flushing_caps(mdsc, s); mutex_unlock(&s->s_mutex); wake_up_session_caps(s, RECONNECT); } + ceph_put_mds_session(s); } /* -- 2.34.1