Re: [bug report] libceph: potential out-of-bounds access in reopen_osd()

CC: [email protected]

On Mon, 2026-06-08 at 10:45 +0200, Raphael Zimmer wrote:
> Hi,
> 
> I encountered a bug in the libceph module. The bug manifests as an
> out-of-bounds memory access when attempting to access the osd_addr
> array
> in an osdmap. The out-of-bounds access can occur in reopen_osd()
> (net/ceph/osd_client.c).
> 
> The problem seems to be as follows:
> An osdmap contains information about the OSDs in the cluster. Its
> array
> fields, such as osd_addr, are allocated with a length that
> corresponds
> to the max_osd value in the osdmap.
> If a Ceph monitor or OSD sends a new (incremental) osdmap in a
> message
> of type CEPH_MSG_OSD_MAP, the max_osd value is updated, and the array
> fields of the current osdmap are reallocated.
> If the osdmap contains fewer OSDs than the previous one, the size of
> the
> arrays shrinks. This can result in having a connection to an OSD with
> an
> ID greater than max_osd, which is therefore not represented in the
> updated osdmap. If subsequently a connection fault is triggered,
> e.g.,
> by a malformed message, osd_fault() -> reopen_osd() is called. If
> there
> are still pending requests for this OSD, an attempt is made to read
> the
> OSD's address from the osd_addr array in the current osdmap,
> resulting
> in an out-of-bounds access.
> 
> I suggest fixing the problem by adding a check to reopen_osd() that
> verifies the osd exists in the osdmap before continuing to reopen the
> connection.
> I will send a proposed patch in reply to this email.
> 
> Best regards,
> Raphael