Ilya Dryomov e927ab132b libceph: make decode_pool() more resilient against corrupted osdmaps ...

commit 8c738512714e8c0aa18f8a10c072d5b01c83db39 upstream.

If the osdmap is (maliciously) corrupted such that the encoded length
of ceph_pg_pool envelope is less than what is expected for a particular
encoding version, out-of-bounds reads may ensue because the only bounds
check that is there is based on that length value.

This patch adds explicit bounds checks for each field that is decoded
or skipped.

Cc: stable@vger.kernel.org
Reported-by: ziming zhang <ezrakiez@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Tested-by: ziming zhang <ezrakiez@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-11 15:22:00 +01:00

..

crush

libceph: use swap() macro instead of taking tmp variable

2022-05-25 20:45:13 +02:00

armor.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

auth_none.c

libceph: kill ceph_none_authorizer::reply_buf

2021-06-28 23:49:25 +02:00

auth_none.h

libceph: kill ceph_none_authorizer::reply_buf

2021-06-28 23:49:25 +02:00

auth_x_protocol.h

libceph: fix some spelling mistakes

2021-06-28 23:49:25 +02:00

auth_x.c

libceph: prevent potential out-of-bounds writes in handle_auth_session_key()

2025-12-07 06:18:53 +09:00

auth_x.h

ceph: fix whitespace

2018-08-02 21:33:21 +02:00

auth.c

libceph: remove unnecessary ret variable in ceph_auth_init()

2021-06-28 23:49:25 +02:00

buffer.c

mm: allow !GFP_KERNEL allocations for kvmalloc

2022-01-15 16:30:29 +02:00

ceph_common.c

libceph: fix potential use-after-free in have_mon_and_osd_map()

2025-12-07 06:18:53 +09:00

ceph_hash.c

treewide: Use fallthrough pseudo-keyword

2020-08-23 17:36:59 -05:00

ceph_strings.c

libceph: introduce connection modes and ms_mode option

2020-12-14 23:21:50 +01:00

cls_lock_client.c

libceph: fix doc warnings in cls_lock_client.c

2021-06-28 23:49:25 +02:00

crypto.c

mm: allow !GFP_KERNEL allocations for kvmalloc

2022-01-15 16:30:29 +02:00

crypto.h

libceph, ceph: incorporate nautilus cephx changes

2020-12-14 23:21:50 +01:00

debugfs.c

libceph: fix potential use-after-free in have_mon_and_osd_map()

2025-12-07 06:18:53 +09:00

decode.c

libceph: allow addrvecs with a single NONE/blank address

2021-05-04 16:06:15 +02:00

Kconfig

libceph, ceph: implement msgr2.1 protocol (crc and secure modes)

2020-12-14 23:21:50 +01:00

Makefile

libceph, ceph: implement msgr2.1 protocol (crc and secure modes)

2020-12-14 23:21:50 +01:00

messenger_v1.c

libceph: just wait for more data to be available on the socket

2024-02-16 19:10:53 +01:00

messenger_v2.c

ceph: fix crash in process_v2_sparse_read() for encrypted directories

2025-12-07 06:18:51 +09:00

messenger.c

libceph: fix invalid accesses to ceph_connection_v1_info

2025-09-19 16:32:04 +02:00

mon_client.c

libceph: fix race between delayed_work() and ceph_monc_stop()

2024-07-18 13:21:22 +02:00

msgpool.c

libceph: preallocate message data items

2018-10-22 10:28:22 +02:00

osd_client.c

ceph: allocate sparse_ext map only for sparse reads

2025-01-02 10:32:00 +01:00

osdmap.c

libceph: make decode_pool() more resilient against corrupted osdmaps

2026-01-11 15:22:00 +01:00

pagelist.c

libceph: fix ceph_pagelist_reserve() comment typo

2022-08-03 00:54:13 +02:00

pagevec.c

libceph: remove ceph_get_direct_page_vector()

2019-07-08 14:01:40 +02:00

snapshot.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 268

2019-06-05 17:30:29 +02:00

string_table.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

striper.c

rbd: support for object-map and fast-diff

2019-07-08 14:01:45 +02:00