From 6548a7a98ea7ab01d8804c191809acfc68cc3b27 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 23 Jan 2025 02:44:17 +0000 Subject: [PATCH 1/3] Bump dawidd6/action-download-artifact from 7 to 8 Bumps [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact) from 7 to 8. - [Release notes](https://github.com/dawidd6/action-download-artifact/releases) - [Commits](https://github.com/dawidd6/action-download-artifact/compare/v7...v8) --- updated-dependencies: - dependency-name: dawidd6/action-download-artifact dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/linux.yml | 4 ++-- .github/workflows/macos.yml | 6 +++--- .github/workflows/windows.yml | 6 +++--- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 419c247570..9b0da0f647 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -12,13 +12,13 @@ jobs: runs-on: ubuntu-20.04 if: github.event.workflow_run.conclusion == 'success' steps: - - uses: dawidd6/action-download-artifact@v7 + - uses: dawidd6/action-download-artifact@v8 with: workflow: main_ci.yml workflow_conclusion: success name: output - - uses: dawidd6/action-download-artifact@v7 + - uses: dawidd6/action-download-artifact@v8 with: workflow: main_ci.yml workflow_conclusion: success diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 44ae2d3522..ca51265a29 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -16,19 +16,19 @@ jobs: run: | brew install create-dmg - - uses: dawidd6/action-download-artifact@v7 + - uses: dawidd6/action-download-artifact@v8 with: workflow: main_ci.yml workflow_conclusion: success name: output - - uses: dawidd6/action-download-artifact@v7 + - uses: dawidd6/action-download-artifact@v8 with: workflow: main_ci.yml workflow_conclusion: success name: qemu_macos - - uses: dawidd6/action-download-artifact@v7 + - uses: dawidd6/action-download-artifact@v8 with: workflow: main_ci.yml workflow_conclusion: success diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 8f056d2957..0b05ad6d27 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -12,19 +12,19 @@ jobs: runs-on: ubuntu-20.04 if: github.event.workflow_run.conclusion == 'success' steps: - - uses: dawidd6/action-download-artifact@v7 + - uses: dawidd6/action-download-artifact@v8 with: workflow: main_ci.yml workflow_conclusion: success name: output - - uses: dawidd6/action-download-artifact@v7 + - uses: dawidd6/action-download-artifact@v8 with: workflow: main_ci.yml workflow_conclusion: success name: qemu_w64 - - uses: dawidd6/action-download-artifact@v7 + - uses: dawidd6/action-download-artifact@v8 with: workflow: main_ci.yml workflow_conclusion: success From bc88a4740f9acabcf927bb349cf364c7df1fe9bc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Feb 2025 03:01:44 +0000 Subject: [PATCH 2/3] Bump dawidd6/action-download-artifact from 8 to 9 Bumps [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact) from 8 to 9. - [Release notes](https://github.com/dawidd6/action-download-artifact/releases) - [Commits](https://github.com/dawidd6/action-download-artifact/compare/v8...v9) --- updated-dependencies: - dependency-name: dawidd6/action-download-artifact dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/linux.yml | 4 ++-- .github/workflows/macos.yml | 6 +++--- .github/workflows/windows.yml | 6 +++--- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 9b0da0f647..ec4fa8b731 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -12,13 +12,13 @@ jobs: runs-on: ubuntu-20.04 if: github.event.workflow_run.conclusion == 'success' steps: - - uses: dawidd6/action-download-artifact@v8 + - uses: dawidd6/action-download-artifact@v9 with: workflow: main_ci.yml workflow_conclusion: success name: output - - uses: dawidd6/action-download-artifact@v8 + - uses: dawidd6/action-download-artifact@v9 with: workflow: main_ci.yml workflow_conclusion: success diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index ca51265a29..c31cdf2f83 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -16,19 +16,19 @@ jobs: run: | brew install create-dmg - - uses: dawidd6/action-download-artifact@v8 + - uses: dawidd6/action-download-artifact@v9 with: workflow: main_ci.yml workflow_conclusion: success name: output - - uses: dawidd6/action-download-artifact@v8 + - uses: dawidd6/action-download-artifact@v9 with: workflow: main_ci.yml workflow_conclusion: success name: qemu_macos - - uses: dawidd6/action-download-artifact@v8 + - uses: dawidd6/action-download-artifact@v9 with: workflow: main_ci.yml workflow_conclusion: success diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 0b05ad6d27..8aeda074a9 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -12,19 +12,19 @@ jobs: runs-on: ubuntu-20.04 if: github.event.workflow_run.conclusion == 'success' steps: - - uses: dawidd6/action-download-artifact@v8 + - uses: dawidd6/action-download-artifact@v9 with: workflow: main_ci.yml workflow_conclusion: success name: output - - uses: dawidd6/action-download-artifact@v8 + - uses: dawidd6/action-download-artifact@v9 with: workflow: main_ci.yml workflow_conclusion: success name: qemu_w64 - - uses: dawidd6/action-download-artifact@v8 + - uses: dawidd6/action-download-artifact@v9 with: workflow: main_ci.yml workflow_conclusion: success From 363b03bc688ca6e57ad6264d4899f16fe48da0ea Mon Sep 17 00:00:00 2001 From: Flint <45332979+Mrcopytuo@users.noreply.github.com> Date: Wed, 17 Dec 2025 14:06:58 +0800 Subject: [PATCH 3/3] harden msgr2.1 frame segment length checks --- linux-6.1.11/net/ceph/messenger_v2.c | 40 ++++++++++++++++++---------- 1 file changed, 26 insertions(+), 14 deletions(-) diff --git a/linux-6.1.11/net/ceph/messenger_v2.c b/linux-6.1.11/net/ceph/messenger_v2.c index 3009028c4f..e945e77257 100644 --- a/linux-6.1.11/net/ceph/messenger_v2.c +++ b/linux-6.1.11/net/ceph/messenger_v2.c @@ -392,6 +392,8 @@ static int head_onwire_len(int ctrl_len, bool secure) int head_len; int rem_len; + BUG_ON(ctrl_len < 0 || ctrl_len > CEPH_MSG_MAX_CONTROL_LEN); + if (secure) { head_len = CEPH_PREAMBLE_SECURE_LEN; if (ctrl_len > CEPH_PREAMBLE_INLINE_LEN) { @@ -410,6 +412,10 @@ static int head_onwire_len(int ctrl_len, bool secure) static int __tail_onwire_len(int front_len, int middle_len, int data_len, bool secure) { + BUG_ON(front_len < 0 || front_len > CEPH_MSG_MAX_FRONT_LEN || + middle_len < 0 || middle_len > CEPH_MSG_MAX_MIDDLE_LEN || + data_len < 0 || data_len > CEPH_MSG_MAX_DATA_LEN); + if (!front_len && !middle_len && !data_len) return 0; @@ -522,29 +528,35 @@ static int decode_preamble(void *p, struct ceph_frame_desc *desc) desc->fd_aligns[i] = ceph_decode_16(&p); } - /* - * This would fire for FRAME_TAG_WAIT (it has one empty - * segment), but we should never get it as client. - */ - if (!desc->fd_lens[desc->fd_seg_cnt - 1]) { - pr_err("last segment empty\n"); + if (desc->fd_lens[0] < 0 || + desc->fd_lens[0] > CEPH_MSG_MAX_CONTROL_LEN) { + pr_err("bad control segment length %d\n", desc->fd_lens[0]); return -EINVAL; } - if (desc->fd_lens[0] > CEPH_MSG_MAX_CONTROL_LEN) { - pr_err("control segment too big %d\n", desc->fd_lens[0]); + if (desc->fd_lens[1] < 0 || + desc->fd_lens[1] > CEPH_MSG_MAX_FRONT_LEN) { + pr_err("bad front segment length %d\n", desc->fd_lens[1]); return -EINVAL; } - if (desc->fd_lens[1] > CEPH_MSG_MAX_FRONT_LEN) { - pr_err("front segment too big %d\n", desc->fd_lens[1]); + if (desc->fd_lens[2] < 0 || + desc->fd_lens[2] > CEPH_MSG_MAX_MIDDLE_LEN) { + pr_err("bad middle segment length %d\n", desc->fd_lens[2]); return -EINVAL; } - if (desc->fd_lens[2] > CEPH_MSG_MAX_MIDDLE_LEN) { - pr_err("middle segment too big %d\n", desc->fd_lens[2]); + if (desc->fd_lens[3] < 0 || + desc->fd_lens[3] > CEPH_MSG_MAX_DATA_LEN) { + pr_err("bad data segment length %d\n", desc->fd_lens[3]); return -EINVAL; } - if (desc->fd_lens[3] > CEPH_MSG_MAX_DATA_LEN) { - pr_err("data segment too big %d\n", desc->fd_lens[3]); + + /* + * This would fire for FRAME_TAG_WAIT (it has one empty + * segment), but we should never get it as client. + */ + if (!desc->fd_lens[desc->fd_seg_cnt - 1]) { + pr_err("last segment empty, segment count %d\n", + desc->fd_seg_cnt); return -EINVAL; }