Re: [PATCH] libceph: validate OSD extent maps before cursor advance

[Viacheslav Dubeyko]

On Thu, 2026-07-09 at 22:28 -0400, Michael Bommarito wrote:
> net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-
> read
> data length matches the summed extent lengths, but it does not
> validate
> that each OSD-supplied extent is monotonic and lies inside the
> original
> request range. A malformed authenticated OSD reply can advertise a
> far-forward nonzero extent offset with a matching data length and
> make
> the client advance the message-data cursor beyond the request buffer.
> This reaches the BUG_ON(!*length) assertion in ceph_msg_data_next()
> from
> the client receive path.
> 
> Impact: A malicious or compromised authenticated Ceph OSD peer can
> crash
> a kernel Ceph client via a malformed sparse-read reply.
> 
> Reject sparse extent maps that overflow, move backwards, overlap, or
> extend outside the original sparse-read request before advancing the
> cursor.
> 
> Fixes: f628d7999727 ("libceph: add sparse read support to OSD
> client")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Codex:gpt-5-5-xhigh
> Signed-off-by: Michael Bommarito <michael.bommarito@xxxxxxxxx>
> ---
> 
> I reproduced this with a same-translation-unit KUnit test on
> f5459048c38a, x86_64 with panic_on_oops=1. Without the patch, the
> malformed extent triggers kernel BUG at net/ceph/messenger.c:1117
> after
> the benign in-range control passes. With the patch, the malformed map
> returns -EREMOTEIO and both KUnit cases pass; net/ceph/osd_client.o

Do you have KUnit test? Why do not send the patch with adding KUnit
test(s)?

> builds cleanly with W=1.
>  net/ceph/osd_client.c | 30 ++++++++++++++++++++++++++++++
>  1 file changed, 30 insertions(+)
> 
> diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
> index 2ff00070c1810..76ba3abdad9b1 100644
> --- a/net/ceph/osd_client.c
> +++ b/net/ceph/osd_client.c
> @@ -6,6 +6,7 @@
>  #include <linux/err.h>
>  #include <linux/highmem.h>
>  #include <linux/mm.h>
> +#include <linux/overflow.h>
>  #include <linux/pagemap.h>
>  #include <linux/slab.h>
>  #include <linux/uaccess.h>
> @@ -5799,6 +5800,31 @@ static inline void convert_extent_map(struct
> ceph_sparse_read *sr)
>  }
>  #endif
>  
> +static bool sparse_extent_map_valid(struct ceph_sparse_read *sr)
> +{
> +	u64 req_end, pos;
> +	int i;
> +
> +	if (check_add_overflow(sr->sr_req_off, sr->sr_req_len,
> &req_end))
> +		return false;
> +
> +	pos = sr->sr_req_off;
> +	for (i = 0; i < sr->sr_count; i++) {
> +		struct ceph_sparse_extent *ext = &sr->sr_extent[i];
> +		u64 end;
> +
> +		if (ext->off < pos)
> +			return false;
> +		if (check_add_overflow(ext->off, ext->len, &end))
> +			return false;
> +		if (end > req_end)
> +			return false;
> +		pos = end;
> +	}
> +
> +	return true;
> +}
> +
>  static int osd_sparse_read(struct ceph_connection *con,
>  			   struct ceph_msg_data_cursor *cursor,
>  			   char **pbuf)
> @@ -5856,6 +5882,10 @@ static int osd_sparse_read(struct
> ceph_connection *con,
>  	case CEPH_SPARSE_READ_DATA_PRE:
>  		/* Convert sr_datalen to host-endian */
>  		sr->sr_datalen = le32_to_cpu((__force __le32)sr-
> >sr_datalen);
> +		if (!sparse_extent_map_valid(sr)) {
> +			pr_warn_ratelimited("invalid sparse extent
> map\n");
> +			return -EREMOTEIO;
> +		}
>  		for (i = 0; i < count; i++)
>  			len += sr->sr_extent[i].len;
>  		if (sr->sr_datalen != len) {

Makes sense to me.

Reviewed-by: Viacheslav Dubeyko <slava@xxxxxxxxxxx>

Thanks,
Slava.