REDHAT-BUG-2422801: Use After Free

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix potential use-after-free in havemonandosdmap()

The wait loop in cephopensession() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both cephmonchandlemap() and handleonemap() install a new map immediately after freeing the old one

kfree(monc->monmap); monc->monmap = monmap;

cephosdmapdestroy(osdc->osdmap); osdc->osdmap = newmap;

under client->monc.mutex and client->osdc.lock respectively, but because neither is taken in havemonandosdmap() it's possible for client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in

client->monc.monmap && client->monc.monmap->epoch && client->osdc.osdmap && client->osdc.osdmap->epoch;

condition to dereference an already freed map. This happens to be reproducible with generic/395 and generic/397 with KASAN enabled:

BUG: KASAN: slab-use-after-free in havemonandosdmap+0x56/0x70 Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305 CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266 ... Call Trace: <TASK> havemonandosdmap+0x56/0x70 cephopensession+0x182/0x290 cephgettree+0x333/0x680 vfsgettree+0x49/0x180 donewmount+0x1a3/0x2d0 pathmount+0x6dd/0x730 domount+0x99/0xe0 dosysmount+0x141/0x180 dosyscall64+0x9f/0x100 entrySYSCALL64afterhwframe+0x76/0x7e </TASK>

Allocated by task 13305: cephosdmapalloc+0x16/0x130 cephosdcinit+0x27a/0x4c0 cephcreateclient+0x153/0x190 createfsclient+0x50/0x2a0 cephgettree+0xff/0x680 vfsgettree+0x49/0x180 donewmount+0x1a3/0x2d0 pathmount+0x6dd/0x730 domount+0x99/0xe0 dosysmount+0x141/0x180 dosyscall64+0x9f/0x100 entrySYSCALL64afterhwframe+0x76/0x7e

Freed by task 9475: kfree+0x212/0x290 handleonemap+0x23c/0x3b0 cephosdchandlemap+0x3c9/0x590 mondispatch+0x655/0x6f0 cephconprocessmessage+0xc3/0xe0 cephconv1tryread+0x614/0x760 cephconworkfn+0x2de/0x650 processonework+0x486/0x7c0 processscheduledworks+0x73/0x90 workerthread+0x1c8/0x2a0 kthread+0x2ec/0x300 retfromfork+0x24/0x40 retfromforkasm+0x1a/0x30

Rewrite the wait loop to check the above condition directly with client->monc.mutex and client->osdc.lock taken as appropriate. While at it, improve the timeout handling (previously mounttimeout could be exceeded in case waiteventinterruptibletimeout() slept more than once) and access client->autherr under client->monc.mutex to match how it's set in finishauth().

monmapshow() and osdmapshow() now take the respective lock before accessing the map as well.