Re: [PATCH 1/1] libceph: mon_client: bound get_version reply decode to front len

On Sun, 2026-06-07 at 17:35 +0800, Ren Wei wrote:
> From: Douya Le <[email protected]>
> 
> handle_get_version_reply() uses msg->front_alloc_len as the decode
> boundary for MON_GET_VERSION_REPLY.  That is the size of the reused
> reply buffer, not the number of bytes actually received.
> 
> A truncated reply can therefore pass ceph_decode_need() and decode
> the
> second u64 from stale tail bytes left in the buffer by an earlier
> message, causing an uninitialized memory read.
> 
> Use msg->front.iov_len as the receive-side decode boundary, matching
> other libceph reply handlers and limiting decoding to the bytes that
> were actually read from the wire.
> 
> Fixes: 513a8243d67f ("libceph: mon_get_version request
> infrastructure")
> Cc: [email protected]
> Reported-by: Yuan Tan <[email protected]>
> Reported-by: Zhengchuan Liang <[email protected]>
> Reported-by: Xin Liu <[email protected]>
> Assisted-by: Codex:GPT-5.4
> Signed-off-by: Douya Le <[email protected]>
> Signed-off-by: Ren Wei <[email protected]>
> ---
>  net/ceph/mon_client.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
> index d2cdc8ee3155..fd3ebebe5f4c 100644
> --- a/net/ceph/mon_client.c
> +++ b/net/ceph/mon_client.c
> @@ -821,7 +821,7 @@ static void handle_get_version_reply(struct
> ceph_mon_client *monc,
>  	struct ceph_mon_generic_request *req;
>  	u64 tid = le64_to_cpu(msg->hdr.tid);
>  	void *p = msg->front.iov_base;
> -	void *end = p + msg->front_alloc_len;
> +	void *const end = p + msg->front.iov_len;
>  	u64 handle;
>  
>  	dout("%s msg %p tid %llu\n", __func__, msg, tid);

Makes sense.

Reviewed-by: Viacheslav Dubeyko <[email protected]>

Thanks,
Slava.