[PATCH] ceph: reject create client if no monitor

[Edward Adam Davis]

From: Edward Adam Davis <eadavis@xxxxxx>

During the resolution of monitor addresses, the failure to resolve the
server name [1] resulted in no available monitors (i.e., the num_mon
value in ceph_options was 0).

This triggered the issue [2] when joining the Ceph cluster.

Before creating the client, if the number of monitors specified in the
options is invalid, the client creation process is aborted.

[1]
libceph: resolve '127.0.0.' (ret=-3): failed

[2]
kernel BUG at net/ceph/mon_client.c:211!
Call Trace:
 ceph_monc_open_session+0x46/0x60 net/ceph/mon_client.c:534
 __ceph_open_session+0x135/0x590 net/ceph/ceph_common.c:798
 ceph_real_mount fs/ceph/super.c:1173 [inline]
 ceph_get_tree+0xd98/0x1fd0 fs/ceph/super.c:1362

Fixes: 16725b9d2a2e ("ceph: super.c")
Reported-by: syzbot+1dbed5969931c19d3eb5@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=1dbed5969931c19d3eb5
Tested-by: syzbot+1dbed5969931c19d3eb5@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Edward Adam Davis <eadavis@xxxxxx>
---
 fs/ceph/super.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 72935f665f11..0f20d6c5e4bd 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -818,7 +818,11 @@ static struct ceph_fs_client *create_fs_client(struct ceph_mount_options *fsopt,
 					struct ceph_options *opt)
 {
 	struct ceph_fs_client *fsc;
-	int err;
+	int err, num_mon;
+
+	num_mon = opt->num_mon;
+	if (num_mon == 0 || num_mon > CEPH_MAX_MON)
+		return ERR_PTR(-EINVAL);
 
 	fsc = kzalloc_obj(*fsc);
 	if (!fsc) {
-- 
2.43.0