In the Linux kernel, the following vulnerability has been resolved:
ceph: fix oops due to invalid pointer for kfree() in parse_longname()
This fixes a kernel oops when reading ceph snapshot directories (.snap),
for example by simply running ls /mnt/my_ceph/.snap.
The variable str is guarded by __free(kfree), but advanced by one for skipping the initial '_' in snapshot names. Thus, kfree() is called with an invalid pointer. This patch removes the need for advancing the pointer so kfree() is called with correct memory pointer.
Steps to reproduce:
- Create snapshots on a cephfs volume (I've 63 snaps in my testcase)
- Add cephfs mount to fstab
- Reboot the system
- Check if it's really mounted
- List snapshots (expected 63 snapshots on my system)
Now ls hangs forever and the kernel log shows the oops.