diff options
| author | Douya Le <ldy3087146292@gmail.com> | 2026-05-29 16:11:44 +0800 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2026-07-23 20:29:40 +0200 |
| commit | 05f90284223381005d6bcddab3fda4a97f9c3401 (patch) | |
| tree | 5bd240603c85e9c1999345b7f9317f51593cef56 | |
| parent | 98917a499ec7064c14fc56d180a4fd636fc2784c (diff) | |
| download | linux-05f90284223381005d6bcddab3fda4a97f9c3401.tar.gz linux-05f90284223381005d6bcddab3fda4a97f9c3401.tar.bz2 linux-05f90284223381005d6bcddab3fda4a97f9c3401.zip | |
libceph: reject zero bucket types in crush_decode
CRUSH bucket type 0 is reserved for devices. The mapper relies on
that invariant and uses type 0 to identify leaf devices.
If crush_decode() accepts a bucket with type 0, a malformed CRUSH map
can make the mapper treat a negative bucket ID as a device and pass it
to is_out(), which then indexes the OSD weight array with a negative
value.
Reject zero bucket types while decoding the CRUSH map so the invalid
state never reaches the mapper.
Cc: stable@vger.kernel.org
Fixes: f24e9980eb86 ("ceph: OSD client")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Douya Le <ldy3087146292@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
| -rw-r--r-- | net/ceph/osdmap.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c index 8e77096718c4..3c87f4b24e51 100644 --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -518,6 +518,8 @@ static struct crush_map *crush_decode(void *pbyval, void *end) ceph_decode_need(p, end, 4*sizeof(u32), bad); b->id = ceph_decode_32(p); b->type = ceph_decode_16(p); + if (b->type == 0) + goto bad; b->alg = ceph_decode_8(p); if (b->alg != alg) { b->alg = 0; |