From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1FBBD23D7E3; Tue, 17 Mar 2026 17:17:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773767841; cv=none; b=Fzj6Kh1NtoelPA98U+tpMYPH0wyF+AC4l1iZOktO9prDEALuzYbzbwc+D74TPW9iyr7ZRvCRgnWFNe1Z6S4c8NJrvqUwlUbASEgxz3X2xLaXD0lvVZXPKzokTy1EqMvzh/9XU7r57jEwApOOSoO2nxoes02wGr1MdphxdRM8yZw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773767841; c=relaxed/simple; bh=SlCixQV3dKJDrcSAkQ94bzdYhJCTkml7YskZDAsZk58=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cmqSLDSCY3WUuTeXaHz6YENoPH9+JR8Ooyhn59fRsXOmkjbCoPVnJBgCDN+cqlnwqrVUwODvmdbOsJln0FnwojeC6pe71Kh0Hj99p5/OxMLqEkL/ifO3WCVk1W4LUQaxNpjRLEP9jHYEQ/W3XI16grHRIdG0iFdXgnkEP4umCnA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bNKGtdBR; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="bNKGtdBR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6BDF5C4CEF7; Tue, 17 Mar 2026 17:17:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1773767841; bh=SlCixQV3dKJDrcSAkQ94bzdYhJCTkml7YskZDAsZk58=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bNKGtdBRYdOZ2MLPY0BcCmy7Ao60kd5F91fG8172meQtglnieQQzjqsw4lCQTsIHW G1JGVD7bNgOVyiwlhdhbYQ7mA1aPj2VZrzfKi9qEqZ7ddWz5Vww4BzKjDPHzf7uyTb Ag7NC2eN3XmoY0kAYhrQbaDdTDvaV6pLqnhJ0xLI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Raphael Zimmer , Viacheslav Dubeyko , Ilya Dryomov Subject: [PATCH 6.18 168/333] libceph: Use u32 for non-negative values in ceph_monmap_decode() Date: Tue, 17 Mar 2026 17:33:17 +0100 Message-ID: <20260317163005.590341800@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260317162959.345812316@linuxfoundation.org> References: <20260317162959.345812316@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Raphael Zimmer commit 770444611f047dbfd4517ec0bc1b179d40c2f346 upstream. This patch fixes unnecessary implicit conversions that change signedness of blob_len and num_mon in ceph_monmap_decode(). Currently blob_len and num_mon are (signed) int variables. They are used to hold values that are always non-negative and get assigned in ceph_decode_32_safe(), which is meant to assign u32 values. Both variables are subsequently used as unsigned values, and the value of num_mon is further assigned to monmap->num_mon, which is of type u32. Therefore, both variables should be of type u32. This is especially relevant for num_mon. If the value read from the incoming message is very large, it is interpreted as a negative value, and the check for num_mon > CEPH_MAX_MON does not catch it. This leads to the attempt to allocate a very large chunk of memory for monmap, which will most likely fail. In this case, an unnecessary attempt to allocate memory is performed, and -ENOMEM is returned instead of -EINVAL. Cc: stable@vger.kernel.org Signed-off-by: Raphael Zimmer Reviewed-by: Viacheslav Dubeyko Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov Signed-off-by: Greg Kroah-Hartman --- net/ceph/mon_client.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/net/ceph/mon_client.c +++ b/net/ceph/mon_client.c @@ -72,8 +72,8 @@ static struct ceph_monmap *ceph_monmap_d struct ceph_monmap *monmap = NULL; struct ceph_fsid fsid; u32 struct_len; - int blob_len; - int num_mon; + u32 blob_len; + u32 num_mon; u8 struct_v; u32 epoch; int ret; @@ -112,7 +112,7 @@ static struct ceph_monmap *ceph_monmap_d } ceph_decode_32_safe(p, end, num_mon, e_inval); - dout("%s fsid %pU epoch %u num_mon %d\n", __func__, &fsid, epoch, + dout("%s fsid %pU epoch %u num_mon %u\n", __func__, &fsid, epoch, num_mon); if (num_mon > CEPH_MAX_MON) goto e_inval;