github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

libceph: Fix multiple unsafe decodes in ceph_oloc_decode()

Browse Source 
ceph_oloc_decode handles unchecked data received over the network from
an OSD. Currently, there are multiple decode operations that aren't
covered by any bounds check. Decoding these fields can therefore result
in out-of-bounds reads if a corrupted message is received.

This patch fixes the issue by adding bounds checks covering all
previously uncovered decode operations.

[ idryomov: use ceph_decode_64_safe() for hash ]

Cc: stable@vger.kernel.org
Fixes: 205ee1187a ("libceph: follow redirect replies from osds")
Assisted-by: Cursor
Signed-off-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
This commit is contained in:
Raphael Zimmer 2026-09-09 17:03:53 +02:00 committed by Ilya Dryomov
parent 0405670e50
commit 10655007b9
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/ceph/osd_client.c
View File

@ -3567,6 +3567,7 @@ static int ceph_oloc_decode(void **p, void *end,
ceph_decode_need(p, end, len, e_inval);
struct_end = *p + len;
ceph_decode_need(p, end, 8 + 4 + 4, e_inval);
oloc->pool = ceph_decode_64(p);
*p += 4; /* skip preferred */
@ -3579,7 +3580,7 @@ static int ceph_oloc_decode(void **p, void *end,
if (struct_v >= 5) {
bool changed = false;
len = ceph_decode_32(p);
ceph_decode_32_safe(p, end, len, e_inval);
if (len > 0) {
ceph_decode_need(p, end, len, e_inval);
if (!oloc->pool_ns ||
@ -3598,7 +3599,9 @@ static int ceph_oloc_decode(void **p, void *end,
}
if (struct_v >= 6) {
s64 hash = ceph_decode_64(p);
s64 hash;
ceph_decode_64_safe(p, end, hash, e_inval);
if (hash != -1) {
pr_warn("ceph_object_locator::hash is set\n");
goto e_inval;