libceph: prevent potential out-of-bounds reads in handle_auth_done()

commit 818156caffbf55cb4d368f9c3cac64e458fb49c9 upstream.

Perform an explicit bounds check on payload_len to avoid a possible
out-of-bounds access in the callout.

[ idryomov: changelog ]

Cc: stable@vger.kernel.org
Signed-off-by: ziming zhang <ezrakiez@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
index 3ae0cca89ab8311256173a7dfbd3cf1bfcd46f5c..f163283abc4e9339ddeb4018a598e01116f4517c 100644 (file)
--- a/net/ceph/messenger_v2.c
+++ b/net/ceph/messenger_v2.c
@@ -2405,7 +2405,9 @@ static int process_auth_done(struct ceph_connection *con, void *p, void *end)
 
        ceph_decode_64_safe(&p, end, global_id, bad);
        ceph_decode_32_safe(&p, end, con->v2.con_mode, bad);
+
        ceph_decode_32_safe(&p, end, payload_len, bad);
+       ceph_decode_need(&p, end, payload_len, bad);
 
        dout("%s con %p global_id %llu con_mode %d payload_len %d\n",
             __func__, con, global_id, con->v2.con_mode, payload_len);