From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDF123F6619; Wed, 20 May 2026 17:59:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779299988; cv=none; b=mdDMFWL3cwavvDq3Dq52CNL5PHaOhHgO+Ce1ZPFT/B810deoo1pnXQZ+mLGEwgphpDl8WxV/oJDiK8DfBZBliS9Br9MLY4rtjCEjdV8GxJkxh1Yw2y/NyjwtXvjvsc1nykRwOaF36NVH6wrcSuOdz3469vGKBso6h32yYLvLe0k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779299988; c=relaxed/simple; bh=2KLlaYLiwA/57A+EDRHf4Wycrq5IJTINBmlK50sE9BA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=puaQGH1+CrFTo88Cnt1JbpgC5L8slQ43RpC741DDLdvw3QsrKMq8ftK9zecYTfUO72pYd39zNiUvHLV8AfzsLHBygpRpQQUsJd7ovU8NjFOQq8N5+fFrgfs7S8auYPJgJ6SC037H/VFk8HTuUt/O52I0IOhWs7R0nlBLGFjELOs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=w3uV9yh8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="w3uV9yh8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A4BF81F00893; Wed, 20 May 2026 17:59:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779299984; bh=XWApp8atlEo2B7KOZAbWhB7UGtnzx+8qDaIEW3B8fzw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=w3uV9yh8cDC3lRcjWgr0ATASb9aD3J7g7XMcPGNWfk2m9oZpQiVmMKC2aOE7RdmRW VWBZW7A1tkymV2zBo6KFc+3OiBzW6VIz6hFo1VHKNM7Wbx46FYhvESoGvadx6LdbUl Hq4rvnIhTUWeNC/0xkHNojuoqviml4PPGNYA9gcI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Raphael Zimmer , Ilya Dryomov Subject: [PATCH 6.18 934/957] libceph: Fix potential null-ptr-deref in decode_choose_args() Date: Wed, 20 May 2026 18:23:37 +0200 Message-ID: <20260520162154.844824304@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260520162134.554764788@linuxfoundation.org> References: <20260520162134.554764788@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Raphael Zimmer commit 28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf upstream. A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an array of max_buckets CRUSH buckets is decoded, where some indices may not refer to actual buckets and are therefore set to NULL. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). When decoding a crush_choose_arg_map, a series of choose_args for different buckets is decoded, with the bucket_index being read from the incoming message. It is only checked that the bucket index does not exceed max_buckets, but not that it doesn't point to an index with a NULL bucket. If a (potentially corrupted) message contains a crush_choose_arg_map including such a bucket_index, a null pointer dereference may occur in the subsequent processing when attempting to access the bucket with the given index. This patch fixes the issue by extending the affected check. Now, it is only attempted to access the bucket if it is not NULL. Cc: stable@vger.kernel.org Signed-off-by: Raphael Zimmer Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov Signed-off-by: Greg Kroah-Hartman --- net/ceph/osdmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -390,7 +390,8 @@ static int decode_choose_args(void **p, goto fail; if (arg->ids_size && - arg->ids_size != c->buckets[bucket_index]->size) + (!c->buckets[bucket_index] || + arg->ids_size != c->buckets[bucket_index]->size)) goto e_inval; }