Commit 818156ca authored by ziming zhang's avatar ziming zhang Committed by Ilya Dryomov
Browse files

libceph: prevent potential out-of-bounds reads in handle_auth_done() 



Perform an explicit bounds check on payload_len to avoid a possible
out-of-bounds access in the callout.

[ idryomov: changelog ]

Cc: stable@vger.kernel.org
Signed-off-by: default avatarziming zhang <ezrakiez@gmail.com>
Reviewed-by: default avatarIlya Dryomov <idryomov@gmail.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent 9ace4753

net/ceph/messenger_v2.c

+2 −0
Original line number Diff line number Diff line
@@ -2376,7 +2376,9 @@ static int process_auth_done(struct ceph_connection *con, void *p, void *end) 


	ceph_decode_64_safe(&p, end, global_id, bad);

	ceph_decode_32_safe(&p, end, con->v2.con_mode, bad);



	ceph_decode_32_safe(&p, end, payload_len, bad);

	ceph_decode_need(&p, end, payload_len, bad);



	dout("%s con %p global_id %llu con_mode %d payload_len %d\n",

	     __func__, con, global_id, con->v2.con_mode, payload_len);