[PATCH v3 0/4] ceph: bound untrusted MDS and monitor reply decoders

[Michael Bommarito]

This is v3 of the CephFS decoder-bound series. The four bugs are
independent; each bounds an untrusted length or count that a malicious or
compromised MDS or monitor controls on the wire.

  1/4 rejects a final xattr value length that runs past the xattr blob.
  2/4 bounds MDSCapAuth path and fs_name copies in handle_session().
  3/4 bounds the mdsmap export_targets array for info_v 2/3.
  4/4 caps delegated-inode parsing by per-session population and by one
      reply's aggregate interval length.

Patches 1/4 and 2/4 carry Viacheslav Dubeyko's Reviewed-by from v1. Patch
3/4 carries his Reviewed-by from v2. Patch 4/4 is reworked to address his
v2 review, described below.

Changes in v3:

  - Rebased onto ceph/testing (base-commit fc67edb66b3c9 below); v2 no
    longer applied there. The series applies cleanly with git am on that
    base. Patches 1-3 are unchanged apart from the rebase.

  - Patch 4/4 reworked per review of v2:

    - The per-session count is now enforced in a single place,
      ceph_insert_deleg_ino(), using atomic_add_unless() rather than an
      increment-then-decrement pattern. Since that helper is the only
      caller that grows the count, the per-session population can never
      exceed CEPH_MAX_DELEG_INOS, so the separate per-session pre-check in
      the decode loop is dropped.

    - The per-reply aggregate check is kept. It is the bound that stops one
      reply from spinning the insert loop on duplicate ranges without
      growing the per-session count, which the per-insert cap alone does
      not catch.

    - CEPH_MAX_DELEG_INOS is cast to u64 where it is compared against and
      subtracted from the u64 interval length.

    - The redundant warning in the decode loop is removed;
      ceph_insert_deleg_ino() already logs when the cap is reached, and the
      warnings now report the counts involved.

Michael Bommarito (4):
  ceph: bound xattr value length in __build_xattrs()
  ceph: bound MDSCapAuth path and fs_name decode in handle_session()
  ceph: bound num_export_targets array for mds info v2/v3
  ceph: cap delegated inode count in ceph_parse_deleg_inos()

 fs/ceph/mds_client.c | 67 ++++++++++++++++++++++++++++++++++++++------
 fs/ceph/mds_client.h |  1 +
 fs/ceph/mdsmap.c     |  7 ++++-
 fs/ceph/super.h      |  9 ++++++
 fs/ceph/xattr.c      |  1 +
 5 files changed, 76 insertions(+), 9 deletions(-)


base-commit: fc67edb66b3c9924c4e0bb366a92b32ea13c526a
--
2.53.0