averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-08-05 06:01:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

libceph: prevent potential out-of-bounds reads in handle_auth_done()

Browse Source 
commit 818156caff upstream.

Perform an explicit bounds check on payload_len to avoid a possible
out-of-bounds access in the callout.

[ idryomov: changelog ]

Cc: stable@vger.kernel.org
Signed-off-by: ziming zhang <ezrakiez@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
ziming zhang
2026-01-17 16:29:53 +01:00
committed by Greg Kroah-Hartman
parent d21ec867d8
commit ef208ea331
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/ceph/messenger_v2.c
+2
View File
@@ -2409,7 +2409,9 @@ static int process_auth_done(struct ceph_connection *con, void *p, void *end)
ceph_decode_64_safe(&p, end, global_id, bad);
ceph_decode_32_safe(&p, end, con->v2.con_mode, bad);
ceph_decode_32_safe(&p, end, payload_len, bad);
ceph_decode_need(&p, end, payload_len, bad);
dout("%s con %p global_id %llu con_mode %d payload_len %d\n",
__func__, con, global_id, con->v2.con_mode, payload_len);