Andrew Lukoshko
5c58271075
Drop the 687.5.3/687.5.4 security-ahead patches superseded by the RHEL 687.6.1..687.10.1 backports (1100-1104), and add those backports (1100-1196) sourced from centos-stream-9 and upstream stable. Keep the AlmaLinux-ahead smb cifs.spnego fix (retained as 1197). Bump to 5.14.0-687.10.1.
37 lines
1.2 KiB
Diff
37 lines
1.2 KiB
Diff
From e00c3f71b5cf75681dbd74ee3f982a99cb690c2b Mon Sep 17 00:00:00 2001
|
|
From: Ilya Dryomov <idryomov@gmail.com>
|
|
Date: Mon, 15 Dec 2025 11:53:31 +0100
|
|
Subject: [PATCH] libceph: replace overzealous BUG_ON in
|
|
osdmap_apply_incremental()
|
|
|
|
If the osdmap is (maliciously) corrupted such that the incremental
|
|
osdmap epoch is different from what is expected, there is no need to
|
|
BUG. Instead, just declare the incremental osdmap to be invalid.
|
|
|
|
Cc: stable@vger.kernel.org
|
|
Reported-by: ziming zhang <ezrakiez@gmail.com>
|
|
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
|
|
|
|
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
|
|
index 34b3ab59602f..3377a22e3f6c 100644
|
|
--- a/net/ceph/osdmap.c
|
|
+++ b/net/ceph/osdmap.c
|
|
@@ -1979,11 +1979,13 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end, bool msgr2,
|
|
sizeof(u64) + sizeof(u32), e_inval);
|
|
ceph_decode_copy(p, &fsid, sizeof(fsid));
|
|
epoch = ceph_decode_32(p);
|
|
- BUG_ON(epoch != map->epoch+1);
|
|
ceph_decode_copy(p, &modified, sizeof(modified));
|
|
new_pool_max = ceph_decode_64(p);
|
|
new_flags = ceph_decode_32(p);
|
|
|
|
+ if (epoch != map->epoch + 1)
|
|
+ goto e_inval;
|
|
+
|
|
/* full map? */
|
|
ceph_decode_32_safe(p, end, len, e_inval);
|
|
if (len > 0) {
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|