Patch 1 is the fix from v1 (unchanged), now carrying Viacheslav Dubeyko's
Reviewed-by. Patch 2 adds the KUnit coverage he asked for.

osd_sparse_read() checks that the sparse-read data length matches the summed
extent lengths but never checks that each OSD-supplied extent is monotonic
and stays inside the original request range, so a malformed authenticated
OSD reply can advance the message-data cursor past the request buffer and
hit the BUG_ON(!*length) in ceph_msg_data_next(). Patch 1 rejects such maps
before advancing the cursor.

The KUnit suite in patch 2 drives the real osd_sparse_read() state machine
over a synthesized reply (no OSD, no network). Confirmed before/after on
v7.2-rc3: without patch 1 the out-of-range case faults in
ceph_msg_data_next() while the in-range control passes (1 pass, 1 fail);
with patch 1 both pass.

v1: https://lore.kernel.org/ceph-devel/20260710022837.libceph-sparse-v1@bommarito/

Michael Bommarito (2):
  libceph: validate OSD extent maps before cursor advance
  libceph: add KUnit coverage for OSD sparse-read extent validation

 net/ceph/Kconfig            |  12 +++
 net/ceph/osd_client-kunit.c | 146 ++++++++++++++++++++++++++++++++++++
 net/ceph/osd_client.c       |  34 +++++++++
 3 files changed, 192 insertions(+)
 create mode 100644 net/ceph/osd_client-kunit.c

-- 
2.53.0