Ilya Dryomov a282a2f105 libceph: harden msgr2.1 frame segment length checks ... ceph_frame_desc::fd_lens is an int array. decode_preamble() thus effectively casts u32 -> int but the checks for segment lengths are written as if on unsigned values. While reading in HELLO or one of the AUTH frames (before authentication is completed), arithmetic in head_onwire_len() can get duped by negative ctrl_len and produce head_len which is less than CEPH_PREAMBLE_LEN but still positive. This would lead to a buffer overrun in prepare_read_control() as the preamble gets copied to the newly allocated buffer of size head_len. Cc: stable@vger.kernel.org Fixes: cd1a677cad ("libceph, ceph: implement msgr2.1 protocol (crc and secure modes)") Reported-by: Thelford Williams <thelford@google.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Xiubo Li <xiubli@redhat.com>		2023-07-13 13:18:57 +02:00
..
crush
armor.c
auth.c
auth_none.c
auth_none.h
auth_x.c
auth_x.h
auth_x_protocol.h
buffer.c
ceph_common.c
ceph_hash.c
ceph_strings.c
cls_lock_client.c
crypto.c
crypto.h
debugfs.c
decode.c
Kconfig
Makefile
messenger.c
messenger_v1.c	libceph: Partially revert changes to support MSG_SPLICE_PAGES	2023-06-27 09:32:40 -07:00
messenger_v2.c	libceph: harden msgr2.1 frame segment length checks	2023-07-13 13:18:57 +02:00
mon_client.c
msgpool.c
osd_client.c
osdmap.c
pagelist.c
pagevec.c
snapshot.c
string_table.c
striper.c