linux-kernel - [PATCH] ceph: fix mdsmap decode for v >= 17

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221027152811.7603-1-lhenriques@suse.de>
Date:   Thu, 27 Oct 2022 16:28:11 +0100
From:   Luís Henriques <lhenriques@...e.de>
To:     Xiubo Li <xiubli@...hat.com>, Ilya Dryomov <idryomov@...il.com>,
        Jeff Layton <jlayton@...nel.org>,
        Luís Henriques <lhenriques@...e.de>
Cc:     ceph-devel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] ceph: fix mdsmap decode for v >= 17

Commit d93231a6bc8a ("ceph: prevent a client from exceeding the MDS
maximum xattr size") was merged before the corresponding MDS-side changes
have been merged.  With the introduction of 'bal_rank_mask' in the mdsmap,
the decoding of maps with v>=17 is now incorrect.  Fix this by skipping
the 'bal_rank_mask' string decoding.

Fixes: d93231a6bc8a ("ceph: prevent a client from exceeding the MDS maximum xattr size")
Signed-off-by: Luís Henriques <lhenriques@...e.de>
---
Hi!

This inconsistency was introduced by ceph PR #43284; I think that, before
picking this patch, we need to get PR #46357 merged to avoid new
problems.

Cheers,
--
Luís

 fs/ceph/mdsmap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c
index 3fbabc98e1f7..fe4f1a6c3465 100644
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -379,6 +379,8 @@ struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end, bool msgr2)
 		ceph_decode_skip_8(p, end, bad_ext);
 		/* required_client_features */
 		ceph_decode_skip_set(p, end, 64, bad_ext);
+		/* bal_rank_mask */
+		ceph_decode_skip_string(p, end, bad_ext);
 		ceph_decode_64_safe(p, end, m->m_max_xattr_size, bad_ext);
 	} else {
 		/* This forces the usage of the (sync) SETXATTR Op */