libceph: fix invalid accesses to ceph_connection_v1_info

There is a place where generic code in messenger.c is reading and
another place where it is writing to con->v1 union member without
checking that the union member is active (i.e. msgr1 is in use).

On 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter,
so such a read is almost guaranteed to return a bogus value instead of
0 when msgr2 is in use.  This ends up being fairly benign because the
side effect is just the invalidation of the authorizer and successive
fetching of new tickets.

con->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that
it's being written to can cause more serious consequences, but luckily
it's not something that happens often.

Cc: stable@vger.kernel.org
Fixes: cd1a677cad99 ("libceph, ceph: implement msgr2.1 protocol (crc and secure modes)")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>

diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index d1b5705dc0c648f6515e142b5d756e868491fbbd..9f6d860411cbd114c26332e78fb7e46bfedb6add 100644 (file)
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -1524,7 +1524,7 @@ static void con_fault_finish(struct ceph_connection *con)
         * in case we faulted due to authentication, invalidate our
         * current tickets so that we can get new ones.
         */
-       if (con->v1.auth_retry) {
+       if (!ceph_msgr2(from_msgr(con->msgr)) && con->v1.auth_retry) {
                dout("auth_retry %d, invalidating\n", con->v1.auth_retry);
                if (con->ops->invalidate_authorizer)
                        con->ops->invalidate_authorizer(con);
@@ -1714,9 +1714,10 @@ static void clear_standby(struct ceph_connection *con)
 {
        /* come back from STANDBY? */
        if (con->state == CEPH_CON_S_STANDBY) {
-               dout("clear_standby %p and ++connect_seq\n", con);
+               dout("clear_standby %p\n", con);
                con->state = CEPH_CON_S_PREOPEN;
-               con->v1.connect_seq++;
+               if (!ceph_msgr2(from_msgr(con->msgr)))
+                       con->v1.connect_seq++;
                WARN_ON(ceph_con_flag_test(con, CEPH_CON_F_WRITE_PENDING));
                WARN_ON(ceph_con_flag_test(con, CEPH_CON_F_KEEPALIVE_PENDING));
        }