In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in cephmdsauthmatch() We now free the temporary target path substring allocation on every possible branch, instead of omitting the default branch. In some cases, a memory leak occured, which could rapidly crash the system (depending on how many file accesses were attempted). This was detected in production because it caused a continuous memory growth, eventually triggering kernel OOM and completely hard-locking the kernel. Relevant kmemleak stacktrace: unreferenced object 0xffff888131e69900 (size 128): comm "git", pid 66104, jiffies 4295435999 hex dump (first 32 bytes): 76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65 volumes/containe 72 73 2f 67 69 74 65 61 2f 67 69 74 65 61 2f 67 rs/gitea/gitea/g backtrace (crc 2f3bb450): [<ffffffffaa68fb49>] _kmallocnoprof+0x359/0x510 [<ffffffffc32bf1df>] cephmdscheckaccess+0x5bf/0x14e0 [ceph] [<ffffffffc3235722>] cephopen+0x312/0xd80 [ceph] [<ffffffffaa7dd786>] dodentryopen+0x456/0x1120 [<ffffffffaa7e3729>] vfsopen+0x79/0x360 [<ffffffffaa832875>] pathopenat+0x1de5/0x4390 [<ffffffffaa834fcc>] dofilpopen+0x19c/0x3c0 [<ffffffffaa7e44a1>] dosysopenat2+0x141/0x180 [<ffffffffaa7e4945>] _x64sysopen+0xe5/0x1a0 [<ffffffffac2cc2f7>] dosyscall64+0xb7/0x210 [<ffffffffac400130>] entrySYSCALL64afterhwframe+0x77/0x7f It can be triggered by mouting a subdirectory of a CephFS filesystem, and then trying to access files on this subdirectory with an auth token using a path-scoped capability: $ ceph auth get client.services [client.services] key = REDACTED caps mds = "allow rw fsname=cephfs path=/volumes/" caps mon = "allow r fsname=cephfs" caps osd = "allow rw tag cephfs data=cephfs" $ cat /proc/self/mounts services@[REDACTED].cephfs=/volumes/containers /ceph/containers ceph rw,noatime,name=services,secret=<hidden>,msmode=prefer-crc,mounttimeout=300,acl,monaddr=[REDACTED]:3300,recoversession=clean 0 0 $ seq 1 1000000 | xargs -P32 --replace={} touch /ceph/containers/file-{} && \ seq 1 1000000 | xargs -P32 --replace={} cat /ceph/containers/file-{} [ idryomov: combine if statements, rename rc to path_matched and make it a bool, formatting ]
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-azure-6.11-cloud-tools-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-azure-6.11-headers-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-azure-6.11-tools-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-cloud-tools-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-headers-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-azure-dbgsym" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-extra-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-iwlwifi-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-tools-6.11.0-1015-azure" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-gcp-6.11-headers-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-gcp-6.11-lib-rust-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-gcp-6.11-tools-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-headers-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-headers-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k-dbgsym" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-dbgsym" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-extra-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-extra-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-tools-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-tools-6.11.0-1015-gcp-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-buildinfo-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-buildinfo-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-cloud-tools-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-headers-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-headers-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-26" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-headers-6.11.0-26" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-tools-6.11.0-26" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-6.11.0-26-generic-dbgsym" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k-dbgsym" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic-dbgsym" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-extra-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-ipu6-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-ipu7-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-iwlwifi-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-usbio-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-vision-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-tools-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-tools-6.11.0-26-generic-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-cloud-tools-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-headers-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-headers-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k-dbgsym" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-dbgsym" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-cloud-tools-6.11.0-1014" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-headers-6.11.0-1014" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-lib-rust-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-tools-6.11.0-1014" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-modules-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-modules-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-modules-iwlwifi-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-tools-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-tools-6.11.0-1014-lowlatency-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1022.22", "binary_name": "linux-buildinfo-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-headers-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-image-unsigned-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-image-unsigned-6.11.0-1022-oem-dbgsym" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-ipu6-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-ipu7-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-iwlwifi-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-usbio-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-vision-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-oem-6.11-headers-6.11.0-1022" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-oem-6.11-tools-6.11.0-1022" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-tools-6.11.0-1022-oem" } ] }