From: Max Kellermann <max.kellermann@ionos.com> maillist inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18967 CVE: CVE-2026-89654 Reference: https://lore.kernel.org/ceph-devel/20260904150304.49104-2-max.kellermann@ion... -------------------------------- check_new_map() drops mdsc->mutex while it locks a session, prepares a reconnect, or kicks flushing caps. A concurrent teardown can call __unregister_session() in that window and drop the sessions[] reference. When check_new_map() reacquires mdsc->mutex, its temporary reference may therefore be the only reference keeping the local variable `s` alive. Commit ee611a750955 ("ceph: fix UAF in check_new_map() on session freed during unlock") addressed this by taking a temporary reference around each unlock window, but it drops that reference as soon as mdsc->mutex is reacquired, while `s` is still in use: ceph_get_mds_session(s); mutex_unlock(&mdsc->mutex); mutex_lock(&s->s_mutex); mutex_lock(&mdsc->mutex); ceph_put_mds_session(s); /* may drop the last reference */ ceph_con_close(&s->s_con); /* use-after-free */ mutex_unlock(&s->s_mutex); /* use-after-free */ s->s_state = CEPH_MDS_SESSION_RESTARTING; If the session was unregistered during the window, the sessions[] reference is already gone, so this ceph_put_mds_session() frees it. Additionally, the session could be freed while its s_mutex is locked, which trips the WARN_ON(mutex_is_locked(&s->s_mutex)) in ceph_put_mds_session() and then unlocks freed memory. Fix this by holding a single reference for the whole loop iteration: look the session up with __ceph_lookup_mds_session(), which returns it with a reference held, and release that reference on every exit from the loop body. This subsumes the per-window get/put pairs, so remove them. Fixes: ee611a750955 ("ceph: fix UAF in check_new_map() on session freed during unlock") Cc: stable@vger.kernel.org Signed-off-by: Max Kellermann <max.kellermann@ionos.com> Conflicts: fs/ceph/mds_client.c [This tree still has the CEPH_MDS_SESSION_OPENING close-out path and its forced-close path has no "continue", so the reference is held until the end of the loop body.] Signed-off-by: Chen Yuxi <chenyuxi19@huawei.com> --- fs/ceph/mds_client.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 25219838930c..d419fb67d41c 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -3321,9 +3321,9 @@ static void check_new_map(struct ceph_mds_client *mdsc, newmap->m_epoch, oldmap->m_epoch); for (i = 0; i < oldmap->m_num_mds && i < mdsc->max_sessions; i++) { - if (!mdsc->sessions[i]) + s = __ceph_lookup_mds_session(mdsc, i); + if (!s) continue; - s = mdsc->sessions[i]; oldstate = ceph_mdsmap_get_state(oldmap, i); newstate = ceph_mdsmap_get_state(newmap, i); @@ -3341,13 +3341,10 @@ static void check_new_map(struct ceph_mds_client *mdsc, if (s->s_state == CEPH_MDS_SESSION_OPENING) { /* the session never opened, just close it * out now */ - get_session(s); __unregister_session(mdsc, s); __wake_requests(mdsc, &s->s_waiting); - ceph_put_mds_session(s); } else if (i >= newmap->m_num_mds) { /* force close session for stopped mds */ - get_session(s); __unregister_session(mdsc, s); __wake_requests(mdsc, &s->s_waiting); kick_requests(mdsc, i); @@ -3358,21 +3355,18 @@ static void check_new_map(struct ceph_mds_client *mdsc, remove_session_caps(s); mutex_unlock(&s->s_mutex); - ceph_put_mds_session(s); - mutex_lock(&mdsc->mutex); } else { /* just close it */ - get_session(s); mutex_unlock(&mdsc->mutex); mutex_lock(&s->s_mutex); mutex_lock(&mdsc->mutex); - ceph_put_mds_session(s); ceph_con_close(&s->s_con); mutex_unlock(&s->s_mutex); s->s_state = CEPH_MDS_SESSION_RESTARTING; } } else if (oldstate == newstate) { + ceph_put_mds_session(s); continue; /* nothing new with this mds */ } @@ -3381,11 +3375,9 @@ static void check_new_map(struct ceph_mds_client *mdsc, */ if (s->s_state == CEPH_MDS_SESSION_RESTARTING && newstate >= CEPH_MDS_STATE_RECONNECT) { - get_session(s); mutex_unlock(&mdsc->mutex); send_mds_reconnect(mdsc, s); mutex_lock(&mdsc->mutex); - ceph_put_mds_session(s); } /* @@ -3400,6 +3392,7 @@ static void check_new_map(struct ceph_mds_client *mdsc, ceph_kick_flushing_caps(mdsc, s); wake_up_session_caps(s, 1); } + ceph_put_mds_session(s); } for (i = 0; i < newmap->m_num_mds && i < mdsc->max_sessions; i++) { -- 2.34.1