kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net/ceph
History
Ilya Dryomov 145d140abd libceph: make decode_pool() more resilient against corrupted osdmaps 
commit 8c73851271 upstream.

If the osdmap is (maliciously) corrupted such that the encoded length
of ceph_pg_pool envelope is less than what is expected for a particular
encoding version, out-of-bounds reads may ensue because the only bounds
check that is there is based on that length value.

This patch adds explicit bounds checks for each field that is decoded
or skipped.

Cc: stable@vger.kernel.org
Reported-by: ziming zhang <ezrakiez@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Tested-by: ziming zhang <ezrakiez@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-19 13:09:52 +01:00
..
crush treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
armor.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
auth.c libceph: remove unnecessary ret variable in ceph_auth_init() 2021-06-28 23:49:25 +02:00
auth_none.c libceph: kill ceph_none_authorizer::reply_buf 2021-06-28 23:49:25 +02:00
auth_none.h libceph: kill ceph_none_authorizer::reply_buf 2021-06-28 23:49:25 +02:00
auth_x.c libceph: prevent potential out-of-bounds writes in handle_auth_session_key() 2025-12-07 06:09:36 +09:00
auth_x.h ceph: fix whitespace 2018-08-02 21:33:21 +02:00
auth_x_protocol.h libceph: fix some spelling mistakes 2021-06-28 23:49:25 +02:00
buffer.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ceph_common.c libceph: fix potential use-after-free in have_mon_and_osd_map() 2025-12-07 06:09:36 +09:00
ceph_hash.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
ceph_strings.c libceph: introduce connection modes and ms_mode option 2020-12-14 23:21:50 +01:00
cls_lock_client.c libceph: fix doc warnings in cls_lock_client.c 2021-06-28 23:49:25 +02:00
crypto.c libceph: zero out session key and connection secret 2021-01-04 17:31:32 +01:00
crypto.h libceph, ceph: incorporate nautilus cephx changes 2020-12-14 23:21:50 +01:00
debugfs.c libceph: fix potential use-after-free in have_mon_and_osd_map() 2025-12-07 06:09:36 +09:00
decode.c libceph: allow addrvecs with a single NONE/blank address 2021-05-04 16:06:15 +02:00
Kconfig libceph, ceph: implement msgr2.1 protocol (crc and secure modes) 2020-12-14 23:21:50 +01:00
Makefile libceph, ceph: implement msgr2.1 protocol (crc and secure modes) 2020-12-14 23:21:50 +01:00
messenger.c libceph: fix invalid accesses to ceph_connection_v1_info 2025-10-02 13:39:01 +02:00
messenger_v1.c libceph: fix "Boolean result is used in bitwise operation" warning 2021-01-21 16:49:59 +01:00
messenger_v2.c libceph: harden msgr2.1 frame segment length checks 2023-07-23 13:47:53 +02:00
mon_client.c libceph: fix race between delayed_work() and ceph_monc_stop() 2024-07-18 13:07:42 +02:00
msgpool.c libceph: preallocate message data items 2018-10-22 10:28:22 +02:00
osd_client.c libceph: fix potential hang in ceph_osdc_notify() 2023-08-11 15:13:55 +02:00
osdmap.c libceph: make decode_pool() more resilient against corrupted osdmaps 2026-01-19 13:09:52 +01:00
pagelist.c libceph: introduce ceph_pagelist_alloc() 2018-10-22 10:28:21 +02:00
pagevec.c libceph: remove ceph_get_direct_page_vector() 2019-07-08 14:01:40 +02:00
snapshot.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 268 2019-06-05 17:30:29 +02:00
string_table.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
striper.c rbd: support for object-map and fast-diff 2019-07-08 14:01:45 +02:00