From 4da259ea8bf4bd6a91a63f33630a26592d2353f8 Mon Sep 17 00:00:00 2001 From: Xiang Mei Date: Mon, 14 Sep 2026 21:43:02 -0700 Subject: [PATCH] ceph: fix off-by-one NUL termination in decode_encrypted_symlink() decode_encrypted_symlink() allocates enclen + 1 bytes but writes the NUL terminator at sym[declen + 1] instead of sym[declen]. A malicious MDS can report symlink_len == 0 for an encrypted inode, and base64_decode() returns 0 for a zero-length input, so the store lands one byte past a kmalloc(1) allocation. Terminate at sym[declen], which is always within the allocation. BUG: KASAN: slab-out-of-bounds in ceph_fill_inode (fs/ceph/inode.c:996) Write of size 1 at addr ffff888020aad361 by task kworker/0:0/9 Workqueue: ceph-msgr ceph_con_workfn Call Trace: kasan_report (mm/kasan/report.c:595) ceph_fill_inode (fs/ceph/inode.c:996 fs/ceph/inode.c:1277) ceph_fill_trace (fs/ceph/inode.c:1716) ceph_con_process_message (net/ceph/messenger.c:1424) ceph_con_v1_try_read (net/ceph/messenger_v1.c:1430) ceph_con_workfn (net/ceph/messenger.c:1576) ... The buggy address belongs to the object at ffff888020aad360 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes to the right of allocated 1-byte region [ffff888020aad360, ffff888020aad361) Fixes: 79f2f6ad878c ("ceph: create symlinks with encrypted and base64-encoded targets") Reported-by: co+b0f93e29183ce737@bugs.sh Assisted-by: LLM Signed-off-by: Xiang Mei Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov --- fs/ceph/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c index 28276d818a6a..12d94f2d6ad6 100644 --- a/fs/ceph/inode.c +++ b/fs/ceph/inode.c @@ -1061,7 +1061,7 @@ static int decode_encrypted_symlink(struct ceph_mds_client *mdsc, kfree(sym); return -EIO; } - sym[declen + 1] = '\0'; + sym[declen] = '\0'; *decsym = sym; return declen; }