summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2017-05-23 17:25:10 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-04-13 19:50:10 +0200
commit23ae585a2f0b6a7cba25dbeeaecd094d1d5552f5 (patch)
treee164c11244c88bb1546077db6e1a15351b4b2a7d /net
parentf277940b15eaf529f3a9a8c770044feb19cfd6d2 (diff)
libceph: NULL deref on crush_decode() error path
[ Upstream commit 293dffaad8d500e1a5336eeb90d544cf40d4fbd8 ] If there is not enough space then ceph_decode_32_safe() does a goto bad. We need to return an error code in that situation. The current code returns ERR_PTR(0) which is NULL. The callers are not expecting that and it results in a NULL dereference. Fixes: f24e9980eb86 ("ceph: OSD client") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/ceph/osdmap.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index bc95e48d5cfb..378c9ed00d40 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -295,6 +295,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
u32 yes;
struct crush_rule *r;
+ err = -EINVAL;
ceph_decode_32_safe(p, end, yes, bad);
if (!yes) {
dout("crush_decode NO rule %d off %x %p to %p\n",