ACK: [SRU][Q][PATCH 1/1] libceph: Fix potential out-of-bounds access in crush_decode()

[Edoardo Canepa]

Acked-by: Edoardo Canepa <edoardo.canepa at canonical.com>

On 7/16/26 15:12, Cengiz Can via kernel-team wrote:
> From: Raphael Zimmer <raphael.zimmer at tu-ilmenau.de>
>
> A message of type CEPH_MSG_OSD_MAP containing a crush map with at least
> one bucket has two fields holding the bucket algorithm. If the values
> in these two fields differ, an out-of-bounds access can occur. This is
> the case because the first algorithm field (alg) is used to allocate
> the correct amount of memory for a bucket of this type, while the second
> algorithm field inside the bucket (b->alg) is used in the subsequent
> processing.
>
> This patch fixes the issue by adding a check that compares alg and
> b->alg and aborts the processing in case they differ. Furthermore,
> b->alg is set to 0 in this case, because the destruction of the crush
> map also uses this field to determine the bucket type, which can again
> result in an out-of-bounds access when trying to free the memory pointed
> to by the fields of the bucket. To correctly free the memory allocated
> for the bucket in such a case, the corresponding call to kfree is moved
> from the algorithm-specific crush_destroy_bucket functions to the
> generic crush_destroy_bucket().
>
> Cc: stable at vger.kernel.org
> Signed-off-by: Raphael Zimmer <raphael.zimmer at tu-ilmenau.de>
> Reviewed-by: Ilya Dryomov <idryomov at gmail.com>
> Signed-off-by: Ilya Dryomov <idryomov at gmail.com>
> (cherry picked from commit 4c79fc2d598694bda845b46229c9d48b65042970)
> CVE-2026-52955
> Assisted-by: kybele:claude-opus-4.8
> Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
> ---
>   net/ceph/crush/crush.c | 6 +-----
>   net/ceph/osdmap.c      | 4 ++++
>   2 files changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/net/ceph/crush/crush.c b/net/ceph/crush/crush.c
> index 254ded0b05f6..521aec1d5fc0 100644
> --- a/net/ceph/crush/crush.c
> +++ b/net/ceph/crush/crush.c
> @@ -47,7 +47,6 @@ int crush_get_bucket_item_weight(const struct crush_bucket *b, int p)
>   void crush_destroy_bucket_uniform(struct crush_bucket_uniform *b)
>   {
>   	kfree(b->h.items);
> -	kfree(b);
>   }
>   
>   void crush_destroy_bucket_list(struct crush_bucket_list *b)
> @@ -55,14 +54,12 @@ void crush_destroy_bucket_list(struct crush_bucket_list *b)
>   	kfree(b->item_weights);
>   	kfree(b->sum_weights);
>   	kfree(b->h.items);
> -	kfree(b);
>   }
>   
>   void crush_destroy_bucket_tree(struct crush_bucket_tree *b)
>   {
>   	kfree(b->h.items);
>   	kfree(b->node_weights);
> -	kfree(b);
>   }
>   
>   void crush_destroy_bucket_straw(struct crush_bucket_straw *b)
> @@ -70,14 +67,12 @@ void crush_destroy_bucket_straw(struct crush_bucket_straw *b)
>   	kfree(b->straws);
>   	kfree(b->item_weights);
>   	kfree(b->h.items);
> -	kfree(b);
>   }
>   
>   void crush_destroy_bucket_straw2(struct crush_bucket_straw2 *b)
>   {
>   	kfree(b->item_weights);
>   	kfree(b->h.items);
> -	kfree(b);
>   }
>   
>   void crush_destroy_bucket(struct crush_bucket *b)
> @@ -99,6 +94,7 @@ void crush_destroy_bucket(struct crush_bucket *b)
>   		crush_destroy_bucket_straw2((struct crush_bucket_straw2 *)b);
>   		break;
>   	}
> +	kfree(b);
>   }
>   
>   /**
> diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
> index 7c76eb9d6cee..9401e2dea0a7 100644
> --- a/net/ceph/osdmap.c
> +++ b/net/ceph/osdmap.c
> @@ -517,6 +517,10 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
>   		b->id = ceph_decode_32(p);
>   		b->type = ceph_decode_16(p);
>   		b->alg = ceph_decode_8(p);
> +		if (b->alg != alg) {
> +			b->alg = 0;
> +			goto bad;
> +		}
>   		b->hash = ceph_decode_8(p);
>   		b->weight = ceph_decode_32(p);
>   		b->size = ceph_decode_32(p);
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x20F88172E14F6784.asc
Type: application/pgp-keys
Size: 3167 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260729/909be694/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260729/909be694/attachment.sig>