Re: [PATCH] libceph: Fix multiplication overflow in __decode_pg_upmap_items()

[Viacheslav Dubeyko <slava@dubeyko.com>]

cc: ceph-devel@vger.kernel.org

On Wed, 2026-05-13 at 10:14 +0200, Raphael Zimmer wrote:
> A message of type CEPH_MSG_OSD_MAP holds an OSD map, which typically
> contains a pg_upmap part at its end. When decoding this part in
> __decode_pg_upmap_items(), a len value is decoded from the message to
> determine the number of items and the size of the allocation needed
> for
> them. If the len value is greater than or equal to 2^31, an overflow
> occurs in the multiplication that is performed to determine the
> needed
> size of the incoming buffer to decode, as well as for the length of
> the
> allocation for the ceph_pg_mapping struct. Subsequently, this results
> in
> out-of-bounds writes (and reads) when decoding the incoming message
> fields into the ceph_pg_mapping struct.
> 
> This patch fixes the issue by adding a UL suffix to the literal in
> the
> multiplication to perform it as an unsigned long multiplication.
> 
> Signed-off-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
> ---
>  net/ceph/osdmap.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
> index 8b5b0587a0cf..42b7b5300901 100644
> --- a/net/ceph/osdmap.c
> +++ b/net/ceph/osdmap.c
> @@ -1620,8 +1620,8 @@ static struct ceph_pg_mapping
> *__decode_pg_upmap_items(void **p, void *end,
>  	if ((size_t)len > (SIZE_MAX - sizeof(*pg)) / (2 *
> sizeof(u32)))
>  		return ERR_PTR(-EINVAL);
>  
> -	ceph_decode_need(p, end, 2 * len * sizeof(u32), e_inval);
> -	pg = alloc_pg_mapping(2 * len * sizeof(u32));
> +	ceph_decode_need(p, end, 2UL * len * sizeof(u32), e_inval);
> +	pg = alloc_pg_mapping(2UL * len * sizeof(u32));
>  	if (!pg)
>  		return ERR_PTR(-ENOMEM);
>