From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f44.google.com (mail-qv1-f44.google.com [209.85.219.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9D173BB4A for ; Sat, 6 Jun 2026 19:00:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780772453; cv=none; b=lR3lRXHXSib21o5W985YSr282xTT5LOf1R1HSQLR7FXYZPeIk2C+Sqv1GWyeAWrkjihf4dnEiqSsWxy+hjJ+2+3iYEE0MKu0dSOswyI/CjsB2eQc4mOMFztyxCHuPQS7kgTFBZDPcDtc9ixTv6NIvQEYct/bXu9FMbm85UG72/M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780772453; c=relaxed/simple; bh=G/p1NhEroBtnSctFQHymP/5qrkJPeSykOHnFiiTppw8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Zen4XI2DIhBSq/tZaLeFweAa/U2Ikwz8QgzRW+A6fJMMdz/r0WpBiLg0KPTLLHqawQ8QKMDL3endBE2FJ9n9TWAf+f6SlTu7lcgLHvHQlcNf4Hg6/0/AHJGehdic15mfS3ZjW1ER7FutCuNB9vw1os6oHXkKMZm+5JA8ltn/1Os= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dc942fNb; arc=none smtp.client-ip=209.85.219.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dc942fNb" Received: by mail-qv1-f44.google.com with SMTP id 6a1803df08f44-8ccdf8d4ac5so33957906d6.1 for ; Sat, 06 Jun 2026 12:00:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780772451; x=1781377251; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=LaXCfO1Mwv1k6w0bpsL9U/18c9DbefbI9xxe01qkWag=; b=dc942fNbfiwz5uya30TH7a0o+tvcE7h1eHvwTOCoqH0X2h4BUEI7pTt3iYFeGC6xVK tmJHLXEXQ/8QTaunP0KI27I0A7WW43EoLgWMBCbKAbWwBrwBm2aPwv9tfDuVsbB1xXQq ukG/lB+S2sCCTiD/HCWUeaV7E/EBUqzjdPtmpffH2uwRrtLQFLBdUNJikE70+g4jhhTm YezlLO82GRahax3uGKXiVxPAloaurYLm1Qk9nKb8OEGIIvEwJPCF43jtmTNpZDg6K4/r TIMSzPAXvfDme9Jv0xBa6dHTUsAFDENtInRx/uIR6Sd+NNGPlu8NhEyjAZv1TNGpb3G1 jvmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780772451; x=1781377251; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=LaXCfO1Mwv1k6w0bpsL9U/18c9DbefbI9xxe01qkWag=; b=YM9cn7dlMuqDMQAy5vYqMAKd9A/Inhx8Gs7mgtV/Nspk6wjB2fm0ZP0VHY7NTTC4F9 ySUAss+4peaXy1jnAIsrR18ossWo0AyZA8pKbGv/aKJWl6UeIvZPpe3lm+iNq+maCuZH sM1Xe+1rSt8J7Z3qlKBaVwu9swu1IrGDb2dyI4Id+YeTfGVPLfsd+rIUxM3kuTHI45nY 6N9URvXwSzP8uPLTl7OzwcqjM1qu/3ILYnlRTCvvzZTaQZrtok7kV2zks56ve7o/1GDc FxuxFCOOwyBSOQ24ywUZX6CJB7HgVX7wuRkxZhJUSJS0P+mccwZcF1QCRdcKs+DiqvYS nPtg== X-Forwarded-Encrypted: i=1; AFNElJ+kOEMEX5hGB86tW/uVlaKKxmLbGJGiilocAVPk/5drT3/BRnDWgEo7gRXldyVaYQM4H1m6TKkeUFDIEzo=@vger.kernel.org X-Gm-Message-State: AOJu0Yy1BqfEOCyiFmXfS5DrOHliRHZZ9AhMEE+QQHhgm5F2q9iFcJGU 9JWSRDY4VlOeqMpBV2/GuVgJ3s/j6G7Ch5InZAErFlSWd6Dqt8ICAUi9 X-Gm-Gg: Acq92OFkToZowiB9P79TxklzGfewiAONs3uFfsFSBcYM3rVULhaIaHSc+ofNYFVNDgx /PkH1XTAEBL7hKJ4LK+VYryYgr5+TcoIia6FYG8hk/3KXZtio8lWZl6g7qjs/g+K58k14BFwG/c lgVRh2S+YRZAFir5iHpVGtenPfHEoxf0g+1wJ+D7NBBDGYIM4jD8iUoPtPHM1X3eZtBS7fahje8 8VYtKwtlWzvwCqFHOj5HRGb40lkwFRJ28i70jtqacftny2nD52FyE6UK2CeIdXzcYh7sbLTDk1p sKIif5mRMDTjyFa0FgWW23SFKG45NpfBzhuSVKybVH1vn9ajr70TZu/t7OkthJFu6BJmRkI9mWm BHM0Gszq9CDo4qJbJfZjFik7nIym+Vpo+wyGIbQVW2OM1BWHuOXqAdaQTGs3aarXbmqcj0fGsPG J+olMFumaedoaDd/rBSGlqyohn3P60Zr6g2+FIhlyo/D5rfvN/ecK8aINOjgNbBvT3xpARFZpTl aP24+bcei6QbgQ9m6XXCc96BSHkjRI= X-Received: by 2002:a05:622a:411:b0:517:6351:b401 with SMTP id d75a77b69052e-51795c0763fmr137402321cf.44.1780772447684; Sat, 06 Jun 2026 12:00:47 -0700 (PDT) Received: from server0 (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5179dd9d908sm40084581cf.15.2026.06.06.12.00.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Jun 2026 12:00:46 -0700 (PDT) From: Michael Bommarito To: Ilya Dryomov , Alex Markuze , Viacheslav Dubeyko Cc: ceph-devel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/4] ceph: bound MDSCapAuth path and fs_name decode in handle_session() Date: Sat, 6 Jun 2026 15:00:23 -0400 Message-ID: X-Mailer: git-send-email 2.53.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit handle_session() decodes the MDSCapAuth records carried by a CEPH_SESSION_OPEN message (msg_version >= 6). For each record the match.path and match.fs_name byte strings are read by first decoding a 32-bit length and then copying that many bytes with the bare ceph_decode_copy(). Unlike the surrounding fields, which all use the _safe decode variants, these two copies are not preceded by a ceph_decode_need() bounds check, and the enclosing MDSCapAuth and MDSCapMatch struct_len fields are skipped rather than enforced as an upper bound. A length larger than the bytes remaining in the message front makes ceph_decode_copy() read past the end of the front buffer. The message front is a dedicated allocation (ceph_msg_new2() -> kvmalloc), so the over-read runs off that object. A malicious or compromised MDS can trigger this with the first post-connect message on mount, with no client-side user interaction; under KASAN it is reported as a slab-out-of-bounds read in handle_session(). Impact: a malicious MDS can force the kernel client to read up to 4 GiB past the message front allocation during session setup, crashing the client (out-of-bounds read). Switch both copies to ceph_decode_copy_safe(), which performs the ceph_decode_need() bounds check before the copy and branches to the existing bad label, matching the rest of the decoder and the error path that frees the partially decoded cap_auths array. Fixes: 1d17de9534cb ("ceph: save cap_auths in MDS client when session is opened") Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Viacheslav Dubeyko --- v2: - Add Reviewed-by from Viacheslav Dubeyko. fs/ceph/mds_client.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index ed17e0023705e..4f36ac73305dc 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -4318,7 +4318,9 @@ static void handle_session(struct ceph_mds_session *session, pr_err_client(cl, "No memory for path\n"); goto fail; } - ceph_decode_copy(&p, cap_auths[i].match.path, _len); + ceph_decode_copy_safe(&p, end, + cap_auths[i].match.path, + _len, bad); /* Remove the tailing '/' */ while (_len && cap_auths[i].match.path[_len - 1] == '/') { @@ -4335,7 +4337,9 @@ static void handle_session(struct ceph_mds_session *session, pr_err_client(cl, "No memory for fs_name\n"); goto fail; } - ceph_decode_copy(&p, cap_auths[i].match.fs_name, _len); + ceph_decode_copy_safe(&p, end, + cap_auths[i].match.fs_name, + _len, bad); } ceph_decode_8_safe(&p, end, cap_auths[i].match.root_squash, bad); -- 2.53.0