From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7DD303F1AD5; Mon, 17 Aug 2026 14:10:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786975828; cv=none; b=TBGr0mI6i04cGlv/CjnpXfLC84JE1tlbq02Yc8NiXCD6yumoHdBTKP/GN4ezmg9sivIhsausvRAUpzVlW9pKJX0bEwDPIyyNAg9j2ehy3wfBm1wfd1wimALXQxlKxm2d8gvuTvR3YrufsfjEKmZXoz+kb5pJvLbwJmyC0ydUZBE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786975828; c=relaxed/simple; bh=ojQ0HQw8S8u1Pz1cxn+vNU33kvjYFjeea5Ns3c1X2u4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iI9/nZ4fWGW532Uulh6H1Yu12zrdnCs2tBLslu9nUVaS9bUnGVo08+5YmZ0bjkFH8wRCrRbS0eYlPWyQ6qli6YaIHwrnu5R7etcf6qgYgPMDl05P65p0OTfnnZ9rlpexCiJmHCaz67a2Y290piN6el44tXmBDR7nSYfdFp57POI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2dbJXVEx; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="2dbJXVEx" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A2FEC1F000E9; Mon, 17 Aug 2026 14:10:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786975827; bh=uYbnQNPWAHbaIcFLygVCXoqgDKABBSp6vKG1Eg8GEx4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=2dbJXVEx6tJxnvo+CRDOzg5Y+C74Hm67RqzV7NJ3BafKW95MbWJiVt4lkXKEWYnZ6 NaeOThuukIEYNaPJIZ4QfemLK7M2Wm9g0qkSTG/6XRc3eIYInWHObEIKV2Zs050KAc CZzcHKniOhy8auuXLf6XPoQ4p+FcO22lQPdWhhN4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yuan Tan , Zhengchuan Liang , Xin Liu , Zhao Zhang , Ren Wei , Viacheslav Dubeyko , Ilya Dryomov Subject: [PATCH 5.10 163/389] libceph: guard missing CRUSH type name lookup Date: Mon, 17 Aug 2026 15:30:02 +0200 Message-ID: <20260817132545.536786914@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132538.796021292@linuxfoundation.org> References: <20260817132538.796021292@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Zhao Zhang commit bbeae12fda3384a90fbebc8a19ba9d33f85b5361 upstream. Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in type_names. get_immediate_parent() then dereferences a NULL type_cn and passes an invalid pointer into strcmp(), causing a null-ptr-deref. Skip such malformed parent buckets unless both the bucket name and type name metadata are present. This keeps malformed hierarchy data from crashing locality lookup and safely falls back to "not local". [ idryomov: add WARN_ON_ONCE ] Cc: stable@vger.kernel.org Fixes: 117d96a04f00 ("libceph: support for balanced and localized reads") Reported-by: Yuan Tan Reported-by: Zhengchuan Liang Reported-by: Xin Liu Assisted-by: Codex:GPT-5.4 Signed-off-by: Zhao Zhang Signed-off-by: Ren Wei Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov Signed-off-by: Greg Kroah-Hartman --- net/ceph/osdmap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -3021,8 +3021,11 @@ static int get_immediate_parent(struct c if (b->items[j] != id) continue; - *parent_type_id = b->type; type_cn = lookup_crush_name(&c->type_names, b->type); + if (WARN_ON_ONCE(!type_cn)) + continue; + + *parent_type_id = b->type; parent_loc->cl_type_name = type_cn->cn_name; parent_loc->cl_name = cn->cn_name; return b->id;