]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
libceph: reject preamble if control segment is empty
authorIlya Dryomov <idryomov@gmail.com>
Sun, 8 Mar 2026 19:01:27 +0000 (20:01 +0100)
committerIlya Dryomov <idryomov@gmail.com>
Tue, 10 Mar 2026 11:16:00 +0000 (12:16 +0100)
commitc4c22b846eceff05b1129b8844a80310e55a7f87
tree0e71fd5d1a386de6d758d36aa336d2d89a9ef033
parenta5a373705081d7cc6363e16990e2361b0b362314
libceph: reject preamble if control segment is empty

While head_onwire_len() has a branch to handle ctrl_len == 0 case,
prepare_read_control() always sets up a kvec for the CRC meaning that
a non-empty control segment is effectively assumed.  All frames that
clients deal with meet that assumption, so let's make it official and
treat the preamble with an empty control segment as malformed.

Cc: stable@vger.kernel.org
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
net/ceph/messenger_v2.c