2018-11-27 08:08:19

by Pan Bian

Subject: [PATCH] libceph: fix use after free

The function ceph_monc_handle_map calls kfree(old) to free the old
monitor map, old points to monc->monmap. However, after that, it reads
monc->monmap->epoch and passes it to __ceph_monc_got_map. This result in
a use-after-free bug. The patch moves the free operation after the call
to __ceph_monc_got_map.

Fixes: 82dcabad750("libceph: revamp subs code, switch to SUBSCRIBE2
protocol")

Signed-off-by: Pan Bian <[email protected]>
---
net/ceph/mon_client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 18deb3d..05ef5aa 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -478,9 +478,10 @@ static void ceph_monc_handle_map(struct ceph_mon_client *monc,
}

client->monc.monmap = monmap;
- kfree(old);

__ceph_monc_got_map(monc, CEPH_SUB_MONMAP, monc->monmap->epoch);
+ kfree(old);
+
client->have_fsid = true;

out:
--
2.7.4

2018-11-27 09:13:34

by Pan Bian

Subject: Re: [PATCH] libceph: fix use after free

On Tue, Nov 27, 2018 at 11:47:56AM +0300, Sergei Shtylyov wrote:
> Hello!
>
> On 27.11.2018 10:02, Pan Bian wrote:
>
> >The function ceph_monc_handle_map calls kfree(old) to free the old
> >monitor map, old points to monc->monmap. However, after that, it reads
> >monc->monmap->epoch and passes it to __ceph_monc_got_map. This result in
> >a use-after-free bug. The patch moves the free operation after the call
> >to __ceph_monc_got_map.
> >
> >Fixes: 82dcabad750("libceph: revamp subs code, switch to SUBSCRIBE2
>
> Space needed before (.
>
> >protocol")
>
> Never break up the commit summary in this tag.

Thanks for the guidance, I will correct it.

>
> >Signed-off-by: Pan Bian <[email protected]>
> [...]
>
> MBR, Sergei

2018-11-27 11:15:38

by Sergei Shtylyov

Subject: Re: [PATCH] libceph: fix use after free

Hello!

On 27.11.2018 10:02, Pan Bian wrote:

> The function ceph_monc_handle_map calls kfree(old) to free the old
> monitor map, old points to monc->monmap. However, after that, it reads
> monc->monmap->epoch and passes it to __ceph_monc_got_map. This result in
> a use-after-free bug. The patch moves the free operation after the call
> to __ceph_monc_got_map.
>
> Fixes: 82dcabad750("libceph: revamp subs code, switch to SUBSCRIBE2

Space needed before (.

> protocol")

Never break up the commit summary in this tag.

> Signed-off-by: Pan Bian <[email protected]>
[...]

MBR, Sergei