Linux kernel libceph: NULL dereference in CRUSH locality lookup when a parent bucket's type name is missing

Impact

During localized read selection the client walks a parent bucket whose name is present in the CRUSH map but whose type has no entry in type_names; get_immediate_parent() then dereferences a NULL type_cn and hands an invalid pointer to strcmp(), producing a NULL pointer dereference in the kernel. A malformed CRUSH hierarchy - corrupted in transit or served by a compromised monitor - therefore crashes any node using the in-kernel CephFS or RBD client with localized reads enabled. On a GPU node that is a hard stop for every job resident on it, and the node has to be rebooted rather than drained gracefully. The fix skips malformed parent buckets and falls back to treating the read as non-local, so correctness degrades rather than the machine dying.

Who can reach it

Whoever controls the CRUSH map content the kernel client receives - realistically a compromised or impersonated Ceph monitor, or injection on an unauthenticated storage network. Requires the client to be doing localized read selection.

What to do

Pick up the stable-kernel fix that guards the missing CRUSH type name lookup (backported across five stable branches, see the git.kernel.org commits) and reboot each node running the kernel Ceph client. Kernel change, so drain and reboot per node; there is no runtime mitigation short of not using the in-kernel client or disabling localized reads.

References