Description

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_caps() with stale mds_wanted A reader can hang forever in __ceph_get_caps() when the client no longer holds `FILE_RD`, but local cap state still says that the capability is already wanted (via `mds_wanted`). One way to trigger this is through MDS cap revocation. If another client performs a conflicting operation, the MDS can revoke `FILE_RD` from the reader; the next read then has to reacquire `FILE_RD`. If the cap update that should request `FILE_RD` never reaches the MDS after `cap->mds_wanted` was raised, the reader is left holding only non-file caps while local `mds_wanted` still includes the file read caps. In that state, try_get_cap_refs() sees `need <= mds_wanted` and returns 0, so __ceph_get_caps() just waits on `i_cap_wq`. If the cap update that was supposed to request `FILE_RD never reaches the MDS after `cap->mds_wanted was` raised, no further request is sent and the waiter can sleep indefinitely until unrelated cap traffic happens to wake it up. The ordering issue is that `cap->mds_wanted` is updated in __prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually queued for send. That makes one field serve two different meanings at once: what this client wants, and what the client believes the MDS already knows it wants. A proper fix would be to split those states and track whether a cap update is actually in flight or has been observed by the MDS. However, simply moving the `cap->mds_wanted assignment` later would not be sufficient: queueing the message in the messenger does not guarantee that the MDS processed that specific wanted set, and reconnect or message loss can still invalidate that assumption. Fixing that properly would require a larger rework of the cap state machine. To allow simpler backports to stable kernels, this patch implements a simpler workaround: - stop waiting forever in __ceph_get_caps(); after a bounded wait, fall back to the renew path - make ceph_renew_caps() issue a synchronous `OPEN` request whenever the inode still does not actually hold the wanted caps, instead of only calling ceph_check_caps() The extra issued-vs-wanted check in ceph_renew_caps() is necessary because the previous test only checked whether the inode still had any real caps at all. That is not enough after revocation: the client can still hold something like `pLs` and yet be missing `FILE_RD` completely. In that case, falling back to ceph_check_caps() is not sufficient, because it still trusts `cap->mds_wanted` and may resend nothing. By requiring `(issued & wanted) == wanted` before taking the asynchronous path, the code only uses ceph_check_caps() when the `wanted caps` are already actually issued. Otherwise, it sends the synchronous `OPEN` renew. This preserves the existing asynchronous fast path when the wanted caps are already issued, avoids changing cap-state semantics, and fixes the hang by guaranteeing that a stalled waiter eventually retries through a path that does not rely on the stale `mds_wanted` state. [ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to mds_client.h, formatting ]

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T15:17:06.490Z",
  "pubdate": "2026-08-26T15:17:06.490Z",
  "executiveSummary": "A deadlock vulnerability exists in the Linux kernel Ceph file system client, specifically within the capability management subsystem.\nThe flaw occurs during the synchronization of file capabilities (caps) between the client and the Metadata Server (MDS), potentially causing a permanent hang for reader processes.\nThis issue stems from an inconsistency between local capability state ('mds_wanted') and the actual caps issued by the MDS, triggered when a read capability is revoked.\nAffected systems include Linux kernel environments utilizing the Ceph file system.\nThe vulnerability leads to a denial-of-service (DoS) condition where specific read operations on an inode are indefinitely blocked, as the client waits for a capability update that will never be processed.\nExploitation does not require elevated privileges; rather, it occurs due to specific, possibly concurrent, network or MDS interactions during capability revocation, which forces the client into a stale state.",
  "technicalDetails": "The root cause is a logic error in ' __ceph_get_caps()' where the client incorrectly assesses its capability requirements when 'mds_wanted' becomes stale. In the Ceph protocol, the client tracks 'mds_wanted' to inform the MDS of required permissions. Under normal operation, ' __prep_cap()' updates 'mds_wanted' before queuing a 'CEPH_MSG_CLIENT_CAPS' message to the MDS.\nIf a revocation occurs—such as a conflicting operation from another client—the MDS may rescind the 'FILE_RD' capability. If the client's request to reacquire the capability is not correctly handled or if the message transmission fails to guarantee that the MDS processes the updated requirement, the client retains a 'mds_wanted' bit that no longer matches the MDS's view.\nDuring this state, 'try_get_cap_refs()' performs a check: 'need <= mds_wanted'. Because the client still 'wants' the read capability, this condition evaluates to true, causing the function to return 0. The execution flow then results in ' __ceph_get_caps()' waiting indefinitely on 'i_cap_wq'. Because the client believes it has already requested the capability, it ceases to send further requests, resulting in a permanent wait unless an unrelated event triggers a wake-up.\nThe attack flow involves the client holding an inode for reading, followed by an MDS-initiated revocation of 'FILE_RD'. The client fails to synchronize its local 'mds_wanted' state with the reality of its missing permissions. Any subsequent read operation will enter ' __ceph_get_caps()', observe that 'mds_wanted' indicates the intent to hold the capability, and block indefinitely. This effectively hangs the process attempting to read the file.\nThe fix introduces a bounded wait period within ' __ceph_get_caps()'. If the threshold is exceeded, the system falls back to a renewal path. Furthermore, 'ceph_renew_caps()' is modified to strictly verify 'issued & wanted == wanted'. If the local inode does not possess the necessary caps, it triggers a synchronous 'OPEN' request rather than relying on the potentially stale 'mds_wanted' state used by 'ceph_check_caps()'. This ensures that the client actively re-synchronizes its state with the MDS, bypassing the stale cache."
}