| From foo@baz Mon Apr 9 17:09:24 CEST 2018 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Tue, 23 May 2017 17:25:10 +0300 |
| Subject: libceph: NULL deref on crush_decode() error path |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| |
| [ Upstream commit 293dffaad8d500e1a5336eeb90d544cf40d4fbd8 ] |
| |
| If there is not enough space then ceph_decode_32_safe() does a goto bad. |
| We need to return an error code in that situation. The current code |
| returns ERR_PTR(0) which is NULL. The callers are not expecting that |
| and it results in a NULL dereference. |
| |
| Fixes: f24e9980eb86 ("ceph: OSD client") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Reviewed-by: Ilya Dryomov <idryomov@gmail.com> |
| Signed-off-by: Ilya Dryomov <idryomov@gmail.com> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/ceph/osdmap.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/net/ceph/osdmap.c |
| +++ b/net/ceph/osdmap.c |
| @@ -295,6 +295,7 @@ static struct crush_map *crush_decode(vo |
| u32 yes; |
| struct crush_rule *r; |
| |
| + err = -EINVAL; |
| ceph_decode_32_safe(p, end, yes, bad); |
| if (!yes) { |
| dout("crush_decode NO rule %d off %x %p to %p\n", |
