Bug 2203906

Summary:	client: possibly wild pointer read when reconnection to mds
Product:	[Red Hat Storage] Red Hat Ceph Storage	Reporter:	Venky Shankar <vshankar>
Component:	CephFS	Assignee:	Venky Shankar <vshankar>
Status:	CLOSED ERRATA	QA Contact:	Hemanth Kumar <hyelloji>
Severity:	medium	Docs Contact:	Akash Raj <akraj>
Priority:	unspecified
Version:	5.3	CC:	akraj, ceph-eng-bugs, cephqe-warriors, tserlin
Target Milestone:	---
Target Release:	6.1z1
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ceph-17.2.6-90.el9cp	Doc Type:	Bug Fix
Doc Text:	.Structure variables are no longer stale or unsafe when accessed after session reconnection Previously, the Ceph File System user-space clients could access stale/unsafe structure variables when rebuilding a request and this would lead to the clients misbehaving sometimes after reconnecting to the Ceph Manager daemons while re-issuing requests. With this fix, the structure variables are no longer stale or unsafe when accessed after session reconnection. This is ensured by deep-copying them instead of shallow-copying and the Ceph File System (CephFS) user-space clients work as expected.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-03 16:45:09 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2221020

Description Venky Shankar 2023-05-15 14:52:35 UTC

Comment 1 RHEL Program Management 2023-05-15 14:52:46 UTC

Please specify the severity of this bug. Severity is defined here:
https://bugzilla.redhat.com/page.cgi?id=fields.html#bug_severity.

Comment 2 Venky Shankar 2023-05-15 14:54:32 UTC

Note to QE - verification for this can be done through running the build through sanity.

Problem:

We use `shallow_copy`(24279ef8) for `MetaRequest::set_caller_perms ` in `Client::make_request` but indeed the lifetime of `MetaRequest` is possible to longer than a `syscall`, because the request will return when they received `unsafe_reply` with release the `UserPerms`, but the `MetaRequest` will not unregister immediately, we have to rebuild the `MClientRequest` when mds reboot, in `send_reconnect`, and that's will access `MetaRequest::perms::gids` again.

int Client::make_request(MetaRequest* request, const UserPerm& perms,
                         InodeRef* ptarget, bool* pcreated, mds_rank_t use_mds,
                         bufferlist* pdirbl)
{
    ...
    request->set_caller_perms(perms);

struct MetaRequest
{
    ...
    void set_caller_perms(const UserPerm& _perms) {
        perms.shallow_copy(_perms);

Comment 12 errata-xmlrpc 2023-08-03 16:45:09 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat Ceph Storage 6.1 Bug Fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:4473