In the Linux kernel, the following vulnerability has been resolved:
ceph: drop messages from MDS when unmounting
When unmounting all the dirty buffers will be flushed and after the last osd request is finished the last reference of the icount will be released. Then it will flush the dirty cap/snap to MDSs, and the unmounting won't wait the possible acks, which will ihold the inodes when updating the metadata locally but makes no sense any more, of this. This will make the evictinodes() to skip these inodes.
If encrypt is enabled the kernel generate a warning when removing the encrypt keys when the skipped inodes still hold the keyring:
WARNING: CPU: 4 PID: 168846 at fs/crypto/keyring.c:242 fscryptdestroykeyring+0x7e/0xd0 CPU: 4 PID: 168846 Comm: umount Tainted: G S 6.1.0-rc5-ceph-g72ead199864c #1 Hardware name: Supermicro SYS-5018R-WR/X10SRW-F, BIOS 2.0 12/17/2015 RIP: 0010:fscryptdestroykeyring+0x7e/0xd0 RSP: 0018:ffffc9000b277e28 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88810d52ac00 RCX: ffff88810b56aa00 RDX: 0000000080000000 RSI: ffffffff822f3a09 RDI: ffff888108f59000 RBP: ffff8881d394fb88 R08: 0000000000000028 R09: 0000000000000000 R10: 0000000000000001 R11: 11ff4fe6834fcd91 R12: ffff8881d394fc40 R13: ffff888108f59000 R14: ffff8881d394f800 R15: 0000000000000000 FS: 00007fd83f6f1080(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f918d417000 CR3: 000000017f89a005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> genericshutdownsuper+0x47/0x120 killanonsuper+0x14/0x30 cephkillsb+0x36/0x90 [ceph] deactivatelockedsuper+0x29/0x60 cleanupmnt+0xb8/0x140 taskworkrun+0x67/0xb0 exittousermodeprepare+0x23d/0x240 syscallexittousermode+0x25/0x60 dosyscall64+0x40/0x80 entrySYSCALL64after_hwframe+0x63/0xcd RIP: 0033:0x7fd83dc39e9b
Later the kernel will crash when iput() the inodes and dereferencing the "sb->smasterkeys", which has been released by the genericshutdownsuper().
[
{
"digest": {
"function_hash": "139881667975068344203875758319124378202",
"length": 361.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-0370bd53",
"signature_version": "v1",
"target": {
"function": "ceph_kill_sb",
"file": "fs/ceph/super.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"46755364904016294469918514799193513471",
"165852355404807912131169243165872169788",
"9567498185533673387564739233505921859",
"53053573097717842447560533604213322246",
"184885951487261221190028013941351683597",
"215602408115078187771406754188414294269",
"209947191845572855138083317592353629807",
"69922081289255943892568924715266528134",
"222769552116300293526658074122745546595",
"184769225832672120108748435965845815453",
"294124530849879375668211693157033307970",
"43407706763131739228106739139668598589",
"254213824910264284205671464847365691186",
"166611414405196427906397329781149922972",
"50391090766258608847208758122551951272",
"208048482671446308189676317634043264516"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-08076afd",
"signature_version": "v1",
"target": {
"file": "fs/ceph/snap.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"141155393469744560915696803366866109057"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-0f3e1f2a",
"signature_version": "v1",
"target": {
"file": "fs/ceph/super.h"
}
},
{
"digest": {
"function_hash": "105991676370873333505093475041280731868",
"length": 2287.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-13af36fb",
"signature_version": "v1",
"target": {
"function": "handle_lease",
"file": "fs/ceph/mds_client.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"205628783563554722226818124908511414388",
"228836034417597103870617352138953188216",
"57372870571184096113007287716181758363",
"224732527655927622895184595627095537019",
"301006635238914761869984700314831198757",
"317334375299838131776851008759032790979",
"86568838695603417127132800247196283976",
"206875321481373595663314548685068697295",
"138786030111613786751737309208068034059",
"91754066844698096599623113649133379414",
"257852352426188387388755330435638813208"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-33cbded8",
"signature_version": "v1",
"target": {
"file": "fs/ceph/super.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"156452035104853717182068830507875402053",
"284915395806448460268068903974634523071",
"30715329502559541255866317222123387147",
"89637142461573633154952488965585998705",
"167290824900260035345561425335216699447",
"288142489375911611586263325222420584181",
"154289584703195932199162515221130644315",
"160888106613511867556108582627984429556",
"52435222746817140871674981978693568471",
"237482817870460996687966738656023646845",
"298795451704942445324776490501269494584"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-3624b36d",
"signature_version": "v1",
"target": {
"file": "fs/ceph/caps.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"294231509677805405373950291532822253541",
"38296134915281498644456819653721049211",
"199211314568433144850665521641716947763",
"17807180840964094533186700621237784623",
"328583946525917342044394193664469070185",
"134899572760705844819896904974734045629",
"39504238214284268385667764190569596970",
"246854341868885359669836246075665029947",
"219280858663981302836126387200505284346",
"294662241421550716184892939573697385538",
"23375029304731422734522892290134475686",
"280690839307969418434823959759234529254",
"191711698674481349379914230232988919349",
"31997329207271303760892126938238002352",
"36975299655259293941129489215026242398",
"233041609441261093339912202589411499797",
"284731088591087686708918259238061483421",
"247151072893397481003729676951192421432",
"321084633974065869034929742933410722816",
"262055695655467399613367550784085678173",
"165544251883337839041211141211001191814",
"290738550012069340254891892471940760809"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-42a313ed",
"signature_version": "v1",
"target": {
"file": "fs/ceph/quota.c"
}
},
{
"digest": {
"function_hash": "238266959300089346286586720453449617988",
"length": 5279.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-4717f28a",
"signature_version": "v1",
"target": {
"function": "ceph_handle_caps",
"file": "fs/ceph/caps.c"
}
},
{
"digest": {
"function_hash": "92228110844115890654252595480410328478",
"length": 999.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-493fe3e2",
"signature_version": "v1",
"target": {
"function": "ceph_handle_quota",
"file": "fs/ceph/quota.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"272046454393581002211516436878459566416",
"294708892578840677862513057332484102172",
"20316334405683141308303406531957365940",
"56367310195715006329158754203202459126",
"19941192762569934760065268448004038240",
"260312386860660687019052697881678902188",
"206550802996137943734015790414618892554",
"236759180587949097291397071681513274002",
"78752333581017784640670773138227929985",
"265584946603217727718046771782024623986",
"210919069971183739054758672914751381329",
"90026838494280557958438114248992978360",
"87438769718804614459796912571067567845",
"335904417430220292777655374030734313375",
"267969741043042199547798989614232343261",
"48994469621280705453758097698118427877",
"211359584326723683539365128364801498327"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-6094078b",
"signature_version": "v1",
"target": {
"file": "fs/ceph/mds_client.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"205628783563554722226818124908511414388",
"228836034417597103870617352138953188216",
"57372870571184096113007287716181758363",
"224732527655927622895184595627095537019",
"301006635238914761869984700314831198757",
"317334375299838131776851008759032790979",
"86568838695603417127132800247196283976",
"206875321481373595663314548685068697295",
"138786030111613786751737309208068034059",
"91754066844698096599623113649133379414",
"257852352426188387388755330435638813208"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-726c6a25",
"signature_version": "v1",
"target": {
"file": "fs/ceph/super.c"
}
},
{
"digest": {
"function_hash": "87381555335405740313383154003679787811",
"length": 1893.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-79702221",
"signature_version": "v1",
"target": {
"function": "ceph_mdsc_init",
"file": "fs/ceph/mds_client.c"
}
},
{
"digest": {
"function_hash": "105991676370873333505093475041280731868",
"length": 2287.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-8097c412",
"signature_version": "v1",
"target": {
"function": "handle_lease",
"file": "fs/ceph/mds_client.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"108053186643974198949495952808931036120",
"212849594706185172745770326068841896997",
"33175331810934349777719646112137680608",
"156382780146245290970295080186468439991",
"38273584545810908075306647418415194295",
"60232706220127286236467033243691107379",
"324022614192816582930761449663271155465",
"284687848072823940071327439981809105615",
"57092821241971705168953416412702397500"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-9d691198",
"signature_version": "v1",
"target": {
"file": "fs/ceph/mds_client.h"
}
},
{
"digest": {
"function_hash": "139881667975068344203875758319124378202",
"length": 361.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-9ec4cf87",
"signature_version": "v1",
"target": {
"function": "ceph_kill_sb",
"file": "fs/ceph/super.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"141155393469744560915696803366866109057"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-b69c742c",
"signature_version": "v1",
"target": {
"file": "fs/ceph/super.h"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"156452035104853717182068830507875402053",
"284915395806448460268068903974634523071",
"30715329502559541255866317222123387147",
"89637142461573633154952488965585998705",
"167290824900260035345561425335216699447",
"288142489375911611586263325222420584181",
"154289584703195932199162515221130644315",
"160888106613511867556108582627984429556",
"52435222746817140871674981978693568471",
"237482817870460996687966738656023646845",
"298795451704942445324776490501269494584"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-bd354587",
"signature_version": "v1",
"target": {
"file": "fs/ceph/caps.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"108053186643974198949495952808931036120",
"212849594706185172745770326068841896997",
"33175331810934349777719646112137680608",
"156382780146245290970295080186468439991",
"38273584545810908075306647418415194295",
"60232706220127286236467033243691107379",
"324022614192816582930761449663271155465",
"284687848072823940071327439981809105615",
"57092821241971705168953416412702397500"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-bffa55fb",
"signature_version": "v1",
"target": {
"file": "fs/ceph/mds_client.h"
}
},
{
"digest": {
"function_hash": "112433289546324240468823331780184105276",
"length": 2801.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-d4cba53f",
"signature_version": "v1",
"target": {
"function": "ceph_handle_snap",
"file": "fs/ceph/snap.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"294231509677805405373950291532822253541",
"38296134915281498644456819653721049211",
"199211314568433144850665521641716947763",
"17807180840964094533186700621237784623",
"328583946525917342044394193664469070185",
"134899572760705844819896904974734045629",
"39504238214284268385667764190569596970",
"246854341868885359669836246075665029947",
"219280858663981302836126387200505284346",
"294662241421550716184892939573697385538",
"23375029304731422734522892290134475686",
"280690839307969418434823959759234529254",
"191711698674481349379914230232988919349",
"31997329207271303760892126938238002352",
"36975299655259293941129489215026242398",
"233041609441261093339912202589411499797",
"284731088591087686708918259238061483421",
"247151072893397481003729676951192421432",
"321084633974065869034929742933410722816",
"262055695655467399613367550784085678173",
"165544251883337839041211141211001191814",
"290738550012069340254891892471940760809"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-d7284558",
"signature_version": "v1",
"target": {
"file": "fs/ceph/quota.c"
}
},
{
"digest": {
"function_hash": "112433289546324240468823331780184105276",
"length": 2801.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-e3b34e0a",
"signature_version": "v1",
"target": {
"function": "ceph_handle_snap",
"file": "fs/ceph/snap.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"46755364904016294469918514799193513471",
"165852355404807912131169243165872169788",
"9567498185533673387564739233505921859",
"53053573097717842447560533604213322246",
"184885951487261221190028013941351683597",
"215602408115078187771406754188414294269",
"209947191845572855138083317592353629807",
"69922081289255943892568924715266528134",
"222769552116300293526658074122745546595",
"184769225832672120108748435965845815453",
"294124530849879375668211693157033307970",
"43407706763131739228106739139668598589",
"254213824910264284205671464847365691186",
"166611414405196427906397329781149922972",
"50391090766258608847208758122551951272",
"208048482671446308189676317634043264516"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-e7e60623",
"signature_version": "v1",
"target": {
"file": "fs/ceph/snap.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"272046454393581002211516436878459566416",
"294708892578840677862513057332484102172",
"20316334405683141308303406531957365940",
"56367310195715006329158754203202459126",
"19941192762569934760065268448004038240",
"260312386860660687019052697881678902188",
"206550802996137943734015790414618892554",
"236759180587949097291397071681513274002",
"78752333581017784640670773138227929985",
"265584946603217727718046771782024623986",
"210919069971183739054758672914751381329",
"90026838494280557958438114248992978360",
"87438769718804614459796912571067567845",
"335904417430220292777655374030734313375",
"267969741043042199547798989614232343261",
"48994469621280705453758097698118427877",
"211359584326723683539365128364801498327"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-f12c6398",
"signature_version": "v1",
"target": {
"file": "fs/ceph/mds_client.c"
}
},
{
"digest": {
"function_hash": "119778904479442693888593159969014169395",
"length": 5414.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-f22015e5",
"signature_version": "v1",
"target": {
"function": "ceph_handle_caps",
"file": "fs/ceph/caps.c"
}
},
{
"digest": {
"function_hash": "87381555335405740313383154003679787811",
"length": 1893.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd",
"id": "CVE-2022-48628-f304d0e5",
"signature_version": "v1",
"target": {
"function": "ceph_mdsc_init",
"file": "fs/ceph/mds_client.c"
}
},
{
"digest": {
"function_hash": "92228110844115890654252595480410328478",
"length": 999.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f82395f04a976d4fa97de7f2acffa1c1096571",
"id": "CVE-2022-48628-fe5b772e",
"signature_version": "v1",
"target": {
"function": "ceph_handle_quota",
"file": "fs/ceph/quota.c"
}
}
]