From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C4A73793A9; Thu, 30 Jul 2026 14:49:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785422987; cv=none; b=G1xlJtPWdrVC/gwNbW6eqwentyaOd3VKZzou82AN0l18OIVd8VPIxUjkxCB/xCJHQCRAE3jJ5nUyz90GGGby5OP18pNz9LSf0NsszHTZydgZx56+nDjNJGoACghDVQKvB4oUeKrAAbp41VrlHlqxWuULOcLaZIThRLBlXp6MFC0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785422987; c=relaxed/simple; bh=CXUsmZM3KlL25yMHKLarIZLm7odUsZY8Kpq5WiIfjEw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aslKlM8aZaJAgjo1vp9hTLabrIOA7AJUm8A73kGepZET0zJR3QbxixBMbIAStAHVm8sA2xJh7VQZjEizWNvloVH+wUJPXAMms1r0FN777Me3ZYRFOsnG0icsyHUjmGaSA2fAWJx6maT5G4GxcsG+S3PHBPsq+3Q8XtF/+mNRkbs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=O7vU80Rw; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="O7vU80Rw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C6F621F000E9; Thu, 30 Jul 2026 14:49:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785422986; bh=OtUSZYfm50jbx8r18MGRYyOQXSMrZjUU+pUlSnZr4GU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=O7vU80Rww01jLWrBOZLbey9yNlhYxybdAoEpVsR4QRMXVsFCWbooMJp+VmCmJ2pzy Rq6WOrzSvRsv/IGXtcprTmb/RdaJRTdmymRlWm2cqFDNWXyH7pLZz5Nteu7plLpniV 7PG4OSCWJq7CANE1P3HQNk/ixk4KVsL5oYtiu/MI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Bryam Vargas , Viacheslav Dubeyko , Ilya Dryomov Subject: [PATCH 7.1 626/744] ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() Date: Thu, 30 Jul 2026 16:14:59 +0200 Message-ID: <20260730141457.581856143@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141444.267951807@linuxfoundation.org> References: <20260730141444.267951807@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bryam Vargas commit 4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02 upstream. ceph_handle_caps() reads snap_trace_len from the wire-format ceph_mds_caps header and uses it unconditionally to build a fake end pointer (snaptrace + snaptrace_len) that is later handed to ceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case: snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); p = snaptrace + snaptrace_len; ... case CEPH_CAP_OP_IMPORT: if (snaptrace_len) { ... if (ceph_update_snap_trace(mdsc, snaptrace, snaptrace + snaptrace_len, false, &realm)) { ... } ceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm from snaptrace using ceph_decode_need(&p, e, sizeof(*ri), bad) with the attacker-supplied fake end e == snaptrace + snaptrace_len. With snaptrace_len == 0xFFFFFFFF the bound check is trivially satisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past the legitimate msg->front buffer, and ri->num_snaps / ri->num_prior_parent_snaps then drive further out-of-bounds reads of the encoded snap arrays. The eleven msg_version >= 2 .. msg_version >= 12 decoder blocks above the op switch each catch this OOB through their ceph_decode_*_safe() / ceph_decode_need() helpers, but they sit behind a hdr.version-gated if, so a malicious or compromised MDS that sets msg->hdr.version = 1 reaches the IMPORT path with no version-gated decoder having validated snap_trace_len. The shape has been present since ceph_handle_caps() was introduced. Validate snap_trace_len against the message front buffer before consuming it, using the canonical ceph_decode_need() / ceph_has_room() helper. The helper bounds the length with subtraction (n <= end - p, guarded by end >= p) rather than pointer addition, so it is wrap-safe for the attacker-controlled u32 length on 32-bit builds where p + snap_trace_len could overflow the address space. This matches the rest of the ceph decode path (e.g. the pool_ns_len check a few lines below), and the existing goto bad cleanup already covers this exit path. Cc: stable@vger.kernel.org Fixes: a8599bd821d0 ("ceph: capability management") Signed-off-by: Bryam Vargas Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov Signed-off-by: Greg Kroah-Hartman --- fs/ceph/caps.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4365,6 +4365,7 @@ void ceph_handle_caps(struct ceph_mds_se snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); + ceph_decode_need(&snaptrace, end, snaptrace_len, bad); p = snaptrace + snaptrace_len; if (msg_version >= 2) {