From 52913831ba56efceaafd80b501d68fa00f79bde6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= Date: Wed, 23 Sep 2026 20:25:34 +0000 Subject: [PATCH] ceph: fix 32-bit overflow in readdir reply count check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit parse_reply_info_readdir() checks how many entries are in a readdir reply by computing the end pointer of the decoded array. That pointer addition can wrap on 32-bit kernels and let an oversized count pass the check. For example, a count of 0x40000000 with 156-byte entries wraps to a zero offset, so the decoder can write past the preallocated buffer. Check the count against the number of entries that fit in the allocation before publishing dir_nr. Reject oversized replies through the existing error path. Cc: stable@vger.kernel.org Fixes: 54008399dc0c ("ceph: preallocate buffer for readdir reply") Assisted-by: LLM Signed-off-by: Jérémy Jean Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov --- fs/ceph/mds_client.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index a207b342e7da..9f13f3f7b800 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -504,10 +504,8 @@ static int parse_reply_info_readdir(void **p, void *end, goto done; BUG_ON(!info->dir_entries); - if ((unsigned long)(info->dir_entries + num) > - (unsigned long)info->dir_entries + info->dir_buf_size) { + if (num > info->dir_buf_size / sizeof(*info->dir_entries)) { pr_err_client(cl, "dir contents are larger than expected\n"); - WARN_ON(1); goto bad; }