github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

libceph: reject mismatched CRUSH weight-set sizes

Browse Source 
A CEPH_MSG_OSD_MAP message can contain CRUSH choose args with replacement
weight vectors for straw2 buckets.  decode_choose_args() validates the
optional IDs vector against the referenced bucket, but does not validate
the size of any replacement-weight vector.

The CRUSH mapper assumes that each replacement vector has exactly as many
entries as the bucket.  A zero-length vector for a nonempty bucket makes
bucket_straw2_choose() dereference NULL, while a shorter nonzero vector
causes an out-of-bounds read.  An authenticated monitor or OSD can deliver
such a map and crash a kernel client when it performs placement for an
ordinary request.

Reject a nonempty collection of weight sets for an absent bucket and
require every replacement-weight vector to match its bucket size.

Cc: stable@vger.kernel.org
Fixes: 5cf9c4a995 ("libceph, crush: per-pool crush_choose_arg_map for crush_do_rule()")
Assisted-by: Codex:gpt-5
Signed-off-by: Felix Hoffmann <f3lix.dev@gmx.de>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
This commit is contained in:
Felix Hoffmann 2026-09-10 13:39:36 +02:00 committed by Ilya Dryomov
parent 10655007b9
commit d8fc89b5bf
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
net/ceph/osdmap.c
View File

@ -376,7 +376,9 @@ static int decode_choose_args(void **p, void *end, struct crush_map *c)
ceph_decode_32_safe(p, end, num_buckets, e_inval);
while (num_buckets--) {
struct crush_choose_arg *arg;
struct crush_bucket *bucket;
u32 bucket_index;
u32 i;
ceph_decode_32_safe(p, end, bucket_index, e_inval);
if (bucket_index >= arg_map->size)
@ -387,10 +389,18 @@ static int decode_choose_args(void **p, void *end, struct crush_map *c)
if (ret)
goto fail;
bucket = c->buckets[bucket_index];
if (arg->ids_size &&
(!c->buckets[bucket_index] ||
arg->ids_size != c->buckets[bucket_index]->size))
(!bucket || arg->ids_size != bucket->size))
goto e_inval;
if (arg->weight_set_size && !bucket)
goto e_inval;
for (i = 0; i < arg->weight_set_size; i++) {
if (arg->weight_set[i].size != bucket->size)
goto e_inval;
}
}
if (!__insert_choose_arg_map(&c->choose_args, arg_map)) {