mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 01:32:21 +02:00
9f00f9cf2b
__decode_pg_temp() decodes an user-controlled length but only rejects
values large enough to overflow the allocation; it does not bound it to
CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and
apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size
on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends
an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack
out-of-bounds write.
An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer
entries at decode time. The bound is well below the old overflow threshold, so
it also covers the allocation-size overflow the previous check guarded against.
BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds
Write of size 4 ... by task exploit
kasan_report (mm/kasan/report.c:595)
ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)
calc_target (net/ceph/osd_client.c:1638)
__submit_request (net/ceph/osd_client.c:2394)
ceph_osdc_start_request (net/ceph/osd_client.c:2490)
ceph_osdc_call (net/ceph/osd_client.c:5164)
rbd_dev_image_probe (drivers/block/rbd.c:6899)
do_rbd_add (drivers/block/rbd.c:7138)
...
kernel BUG at net/ceph/osdmap.c:2670!
[ idryomov: do the same in __decode_pg_upmap_items() ]
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| crush | ||
| armor.c | ||
| auth_none.c | ||
| auth_none.h | ||
| auth_x_protocol.h | ||
| auth_x.c | ||
| auth_x.h | ||
| auth.c | ||
| buffer.c | ||
| ceph_common.c | ||
| ceph_hash.c | ||
| ceph_strings.c | ||
| cls_lock_client.c | ||
| crypto.c | ||
| crypto.h | ||
| debugfs.c | ||
| decode.c | ||
| Kconfig | ||
| Makefile | ||
| messenger_v1.c | ||
| messenger_v2.c | ||
| messenger.c | ||
| mon_client.c | ||
| msgpool.c | ||
| osd_client.c | ||
| osdmap.c | ||
| pagelist.c | ||
| pagevec.c | ||
| snapshot.c | ||
| string_table.c | ||
| striper.c | ||