From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 747A630C366; Fri, 4 Sep 2026 06:09:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788502172; cv=none; b=rLj7sF4FVf4PAyci3OcP3zp7n/Le8SnKhv6QB5zxe4ezKe5t+QO+R0ogZDK3fNu0xrov6SzLmYKAUwNGxPRlEyEzY5D6MJbxGxrijMQKZugjRuUvtugEfm8X4lX9zC7jH/Ts4UTaoplL88ORRK99ye8Fz9xOTwgUa4CsBm2Z7Yg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788502172; c=relaxed/simple; bh=ml5cPwwlK605N4sXyYwS+eDgia938UEhtRDkBBNPnO8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YwW45MBemylAaFMusWr5VtRP+jRv8oPm+FK4/6jEs8SiJaCjYG+fhweWJYlSnHY/wAt/UUFWUFwi+Rlkkl/idgEIdwWc1dD+ADjG1poNtTO8ubQL3C+cE7or22OxaqzuogfoZAiOPnBod/bL+UMYfJQBRoc3hWH7vv5B0GY2G6s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FAnpcBFd; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="FAnpcBFd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CD65A1F00A3D; Fri, 4 Sep 2026 06:09:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788502171; bh=WUCrs9+8JHyv7eoKcLWa0ORFvyy6LNbFk2kdD+TxjNM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=FAnpcBFd98UCP0ONhwCBYn9hYk9vRrCUpNGW7xLuKP25ixo020ZCnXvTipwQ1Rupw Kj1ZsU2UFga2rfW9ofjs/zgBiup609Gr4+Rj24Nb+7YpblBbj0xnqR/rd9VOmBIQxQ 86g4w5mld5XkPIfM65dEK148vSm/+UXoIQXxTu4U= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Michael Bommarito , Viacheslav Dubeyko , Ilya Dryomov Subject: [PATCH 6.12 114/403] ceph: bound MDSCapAuth path and fs_name decode in handle_session() Date: Fri, 4 Sep 2026 06:58:37 +0200 Message-ID: <20260904045737.424155742@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260904045734.806166532@linuxfoundation.org> References: <20260904045734.806166532@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michael Bommarito commit 77933e22adfe813be2bd10be08d6e950103c3967 upstream. handle_session() decodes the MDSCapAuth records carried by a CEPH_SESSION_OPEN message (msg_version >= 6). For each record the match.path and match.fs_name byte strings are read by first decoding a 32-bit length and then copying that many bytes with the bare ceph_decode_copy(). Unlike the surrounding fields, which all use the _safe decode variants, these two copies are not preceded by a ceph_decode_need() bounds check, and the enclosing MDSCapAuth and MDSCapMatch struct_len fields are skipped rather than enforced as an upper bound. A length larger than the bytes remaining in the message front makes ceph_decode_copy() read past the end of the front buffer. The message front is a dedicated allocation (ceph_msg_new2() -> kvmalloc), so the over-read runs off that object. A malicious or compromised MDS can trigger this with the first post-connect message on mount, with no client-side user interaction; under KASAN it is reported as a slab-out-of-bounds read in handle_session(). Impact: a malicious MDS can force the kernel client to read up to 4 GiB past the message front allocation during session setup, crashing the client (out-of-bounds read). Switch both copies to ceph_decode_copy_safe(), which performs the ceph_decode_need() bounds check before the copy and branches to the existing bad label, matching the rest of the decoder and the error path that frees the partially decoded cap_auths array. Cc: stable@vger.kernel.org Fixes: 1d17de9534cb ("ceph: save cap_auths in MDS client when session is opened") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov Signed-off-by: Greg Kroah-Hartman --- fs/ceph/mds_client.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -4268,7 +4268,9 @@ static void handle_session(struct ceph_m pr_err_client(cl, "No memory for path\n"); goto fail; } - ceph_decode_copy(&p, cap_auths[i].match.path, _len); + ceph_decode_copy_safe(&p, end, + cap_auths[i].match.path, + _len, bad); /* Remove the tailing '/' */ while (_len && cap_auths[i].match.path[_len - 1] == '/') { @@ -4285,7 +4287,9 @@ static void handle_session(struct ceph_m pr_err_client(cl, "No memory for fs_name\n"); goto fail; } - ceph_decode_copy(&p, cap_auths[i].match.fs_name, _len); + ceph_decode_copy_safe(&p, end, + cap_auths[i].match.fs_name, + _len, bad); } ceph_decode_8_safe(&p, end, cap_auths[i].match.root_squash, bad);