Re: [bug report] out-of-bounds access in ceph_con_open()

CC: [email protected]

On Mon, 2026-06-29 at 10:40 +0200, Raphael Zimmer wrote:
> Hi,
> I discovered an issue in the libceph module. It results in an
> out-of-bounds access in ceph_con_open(). The behavior can be
> triggered
> by messages of type CEPH_MSG_OSD_MAP from a Ceph monitor or OSD.
> 
> The problem is as follows:
> When decoding an osdmap received in a message of type
> CEPH_MSG_OSD_MAP,
> the max_osd value is decoded in osdmap_set_max_osd(). Furthermore,
> the
> osd_state, osd_weight, and osd_addr arrays are (re)allocated there
> with
> a length equal to this max_osd value. Subsequently, decode_pg_temp()
> and
> decode_primary_temp() are called to decode pg mappings and primary
> osds
> for these. The indices of the osds in these pg mappings are read from
> the message, and there is no guarantee that they actually exist and
> are
> smaller than max_osd. If the message is corrupted, the pg mappings
> can
> afterwards contain osds with indices greater than max_osd. This may
> result in calc_target() calculating a target osd with such an index.
> If
> trying to open a connection to such an osd, the osd_addr array is
> accessed, which only has a length of max_osd, and therefore, an
> out-of-bounds access occurs. A concrete trigger path for this is
> immediately during the processing of the same CEPH_MSG_OSD_MAP
> message.
> After decoding the osdmap, scan_requests() is called from
> handle_one_map(). If there are any linger requests, this function
> calls
> recalc_linger_target(). From there, calc_target() and, if this call
> returns CALC_TARGET_NEED_RESEND, lookup_create_osd() are called.
> lookup_create_osd() may call ceph_con_open() and pass a reference to
> the
> osd_addr array element at the index of the target osd, which results
> in
> the out-of-bounds access.
> 
> Currently, I see at least two ways to handle this problem.
> 1) Treating an osdmap that contains such osd indices as invalid
> directly
> during decoding
> 2) Treating target osds with an index greater than or equal to
> max_osd
> as invalid in calc_target() and, e.g., assigning the request to the
> homeless osd.
> 
> The first option would likely require multiple changes and come with
> more overhead. Therefore, I will send a proposed patch that follows
> the
> second option in reply to this email.
> 
> Best regards,
> Raphael