Re: [PATCH ceph 1/1] libceph: osdmap: guard missing CRUSH type name lookup

On Fri, 2026-06-19 at 15:40 +0800, Ren Wei wrote:
> From: Zhao Zhang <[email protected]>
> 
> Localized read selection can walk a parent bucket whose name exists
> in
> the CRUSH map while its type has no matching entry in type_names.
> get_immediate_parent() then dereferences a NULL type_cn and passes an
> invalid pointer into strcmp(), causing a null-ptr-deref.
> 
> Skip such malformed parent buckets unless both the bucket name and
> type
> name metadata are present. This keeps malformed hierarchy data from
> crashing locality lookup and safely falls back to "not local".
> 
> Fixes: 117d96a04f00 ("libceph: support for balanced and localized
> reads")
> Cc: [email protected]
> Reported-by: Yuan Tan <[email protected]>
> Reported-by: Zhengchuan Liang <[email protected]>
> Reported-by: Xin Liu <[email protected]>
> Assisted-by: Codex:GPT-5.4
> Signed-off-by: Zhao Zhang <[email protected]>
> Signed-off-by: Ren Wei <[email protected]>
> ---
>  net/ceph/osdmap.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
> index 8b5b0587a0cf..5eb50d9c1361 100644
> --- a/net/ceph/osdmap.c
> +++ b/net/ceph/osdmap.c
> @@ -3055,8 +3055,11 @@ static int get_immediate_parent(struct
> crush_map *c, int id,
>  			if (b->items[j] != id)
>  				continue;
>  
> -			*parent_type_id = b->type;
>  			type_cn = lookup_crush_name(&c->type_names,
> b->type);
> +			if (!type_cn)
> +				continue;
> +
> +			*parent_type_id = b->type;
>  			parent_loc->cl_type_name = type_cn->cn_name;
>  			parent_loc->cl_name = cn->cn_name;
>  			return b->id;

Looks good.

Reviewed-by: Viacheslav Dubeyko <[email protected]>

Thanks,
Slava.