The MDS decides how much inline data to attach to a reply, and the client parses inline_len without any upper bound: ceph_decode_need() only verifies that the message actually carries that many bytes. ceph_fill_inline_data() then copies the data into a single folio with no length check, so a malicious or buggy MDS returning more inline data than the folio can hold writes past its end. Clamp the length to folio_size() so both callers, handle_cap_grant() and fill_inode(), are covered. Fixes: 31c542a199d7 ("ceph: add inline data to pagecache") Cc: stable@vger.kernel.org Signed-off-by: Guanglei Zhu --- - rebase onto ceph-client.git testing, where ceph_fill_inline_data() was converted to folios; clamp to folio_size() instead of PAGE_SIZE (reported by Alex Markuze) fs/ceph/addr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c index 4a2d3352a..3c7cf8a5e 100644 --- a/fs/ceph/addr.c +++ b/fs/ceph/addr.c @@ -2266,6 +2266,12 @@ void ceph_fill_inline_data(struct inode *inode, struct folio *locked_folio, doutc(cl, "%p %llx.%llx len %zu locked_folio %p\n", inode, ceph_vinop(inode), len, locked_folio); + if (len > folio_size(folio)) { + pr_warn_ratelimited_client(cl, "oversized inline data %zu\n", + len); + len = folio_size(folio); + } + if (len > 0) memcpy_to_folio(folio, 0, data, len); -- 2.43.0