CVE-2026-80527: ceph: fix hanging __ceph_get_caps() with stale mds_wanted

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix hanging cephgetcaps() with stale mdswanted

A reader can hang forever in cephgetcaps() when the client no longer holds FILERD, but local cap state still says that the capability is already wanted (via mdswanted).

One way to trigger this is through MDS cap revocation. If another client performs a conflicting operation, the MDS can revoke FILERD from the reader; the next read then has to reacquire FILERD. If the cap update that should request FILERD never reaches the MDS after cap->mdswanted was raised, the reader is left holding only non-file caps while local mdswanted still includes the file read caps.

In that state, trygetcaprefs() sees need <= mdswanted and returns 0, so cephgetcaps() just waits on icapwq. If the cap update that was supposed to request FILERD never reaches the MDS after cap->mdswanted was raised, no further request is sent and the waiter can sleep indefinitely until unrelated cap traffic happens to wake it up.

The ordering issue is that cap->mdswanted is updated in prepcap() before the CEPHMSGCLIENTCAPS message is actually queued for send. That makes one field serve two different meanings at once: what this client wants, and what the client believes the MDS already knows it wants.

A proper fix would be to split those states and track whether a cap update is actually in flight or has been observed by the MDS. However, simply moving the cap->mdswanted assignment later would not be sufficient: queueing the message in the messenger does not guarantee that the MDS processed that specific wanted set, and reconnect or message loss can still invalidate that assumption. Fixing that properly would require a larger rework of the cap state machine.

To allow simpler backports to stable kernels, this patch implements a simpler workaround:

- stop waiting forever in cephgetcaps(); after a bounded wait, fall back to the renew path

- make cephrenewcaps() issue a synchronous OPEN request whenever the inode still does not actually hold the wanted caps, instead of only calling cephcheckcaps()

The extra issued-vs-wanted check in cephrenewcaps() is necessary because the previous test only checked whether the inode still had any real caps at all. That is not enough after revocation: the client can still hold something like pLs and yet be missing FILERD completely. In that case, falling back to cephcheckcaps() is not sufficient, because it still trusts cap->mdswanted and may resend nothing. By requiring (issued & wanted) == wanted before taking the asynchronous path, the code only uses cephcheckcaps() when the wanted caps are already actually issued. Otherwise, it sends the synchronous OPEN renew.

This preserves the existing asynchronous fast path when the wanted caps are already issued, avoids changing cap-state semantics, and fixes the hang by guaranteeing that a stalled waiter eventually retries through a path that does not rely on the stale mdswanted state.

[ idryomov: move CEPHGETCAPSWAITTIMEOUT from libceph.h to mdsclient.h, formatting ]