Commit 7fce830ecd0a for kernel

commit 7fce830ecd0a0256590ee37eb65a39cbad3d64fc
Author: ziming zhang <ezrakiez@gmail.com>
Date:   Fri Nov 14 16:56:10 2025 +0800

    libceph: prevent potential out-of-bounds writes in handle_auth_session_key()

    The len field originates from untrusted network packets. Boundary
    checks have been added to prevent potential out-of-bounds writes when
    decrypting the connection secret or processing service tickets.

    [ idryomov: changelog ]

    Cc: stable@vger.kernel.org
    Signed-off-by: ziming zhang <ezrakiez@gmail.com>
    Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index b71b1635916e..a21c157daf7d 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -631,6 +631,7 @@ static int handle_auth_session_key(struct ceph_auth_client *ac, u64 global_id,

 	/* connection secret */
 	ceph_decode_32_safe(p, end, len, e_inval);
+	ceph_decode_need(p, end, len, e_inval);
 	dout("%s connection secret blob len %d\n", __func__, len);
 	if (len > 0) {
 		dp = *p + ceph_x_encrypt_offset();
@@ -648,6 +649,7 @@ static int handle_auth_session_key(struct ceph_auth_client *ac, u64 global_id,

 	/* service tickets */
 	ceph_decode_32_safe(p, end, len, e_inval);
+	ceph_decode_need(p, end, len, e_inval);
 	dout("%s service tickets blob len %d\n", __func__, len);
 	if (len > 0) {
 		ret = ceph_x_proc_ticket_reply(ac, &th->session_key,