[PATCH] fs/ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode

This patch was sent to me privately. Thanks Jeremy. Posting it to the list.

From: Jérémy Jean <[email protected]>

MDSMap export_targets entries are monitor controlled. check_new_map() uses
each entry as a bit number in a fixed stack bitmap, so a rank outside the
protocol namespace can make set_bit() write past the end of the array.

Reject ranks outside CEPH_MAX_MDS while decoding the map. Do not validate
against possible_max_rank here because maps may legitimately reference ranks
beyond a temporarily reduced max_mds.

Fixes: d517b3983dd3 ("ceph: reconnect to the export targets on new mdsmaps")
Cc: [email protected]
Reviewed-by: Alex Markuze <[email protected]>
Signed-off-by: Jérémy Jean <[email protected]>
Signed-off-by: Alex Markuze <[email protected]>
---
 fs/ceph/mdsmap.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c
index 4f0626753429..53079ef34c3a 100644
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -269,6 +269,10 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p,
 				goto nomem;
 			for (j = 0; j < num_export_targets; j++) {
 				target = ceph_decode_32(&pexport_targets);
+				if (target >= CEPH_MAX_MDS) {
+					err = -EIO;
+					goto corrupt;
+				}
 				info->export_targets[j] = target;
 			}
 		} else {
-- 
2.34.1