From cdbb60f00f87297a9db2652847dfc0eaaf3c45aa Mon Sep 17 00:00:00 2001 From: Guanglei Zhu Date: Thu, 10 Sep 2026 11:00:36 +0800 Subject: [PATCH] ceph: fix out-of-bounds read in ceph_netfs_issue_op_inline() The read offset is validated against i_size but never against inline_len, and the two fields come from the MDS independently. When a read starts past the end of the inline data, the subtraction len = min_t(size_t, iinfo->inline_len - subreq->start, subreq->len); underflows and min_t() ends up with subreq->len, so copy_to_iter() reads past the end of the inline buffer straight into the user buffer. A malicious or buggy MDS reporting a short inline payload together with an inflated i_size can thus leak kernel heap memory to userspace. Bail out with -ENODATA when the offset is not within the inline data. Cc: stable@vger.kernel.org Fixes: 5b19f1eba459 ("ceph: make ceph_netfs_issue_op() handle inlined data") Signed-off-by: Guanglei Zhu Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov --- fs/ceph/addr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c index 86fe0e76cdf0..3060d2e9ba0f 100644 --- a/fs/ceph/addr.c +++ b/fs/ceph/addr.c @@ -321,6 +321,12 @@ static bool ceph_netfs_issue_op_inline(struct netfs_io_subrequest *subreq) return false; } + if (subreq->start >= iinfo->inline_len) { + ceph_mdsc_put_request(req); + err = -ENODATA; + goto out; + } + len = min_t(size_t, iinfo->inline_len - subreq->start, subreq->len); err = copy_to_iter(iinfo->inline_data + subreq->start, len, &subreq->io_iter); if (err == 0) {