libceph CrushDecode OOB

Vulnerability analysis

The vulnerability exists in crush_decode() in net/ceph/osdmap.c. When decoding a CRUSH map bucket, the code first reads an 'alg' field to determine the bucket type and allocates memory accordingly (e.g., struct crush_bucket_uniform vs crush_bucket_straw2). It then reads a second 'b->alg' field from inside the bucket data. If these two values differ, subsequent processing and destruction use b->alg to dispatch to algorithm-specific code paths that assume a different struct layout than what was allocated, resulting in out-of-bounds reads and writes. During cleanup, the wrong destroy function reads pointer fields from beyond the allocated struct and passes them to kfree, causing invalid free operations and heap corruption. The fix adds a consistency check comparing alg and b->alg, aborting with an error if they differ (setting b->alg=0 to prevent OOB access during cleanup), and moves the kfree(b) call from algorithm-specific destroy functions to the generic crush_destroy_bucket() to ensure correct cleanup in all cases. The attack surface is network-reachable: a Ceph client receives OSD map messages from the monitor/OSD servers over the network, so a malicious or compromised server can trigger this without any local access.