Commit 293dffaa authored May 23, 2017 by Dan Carpenter Committed by Ilya Dryomov May 23, 2017

libceph: NULL deref on crush_decode() error path



If there is not enough space then ceph_decode_32_safe() does a goto bad.
We need to return an error code in that situation.  The current code
returns ERR_PTR(0) which is NULL.  The callers are not expecting that
and it results in a NULL dereference.

Fixes: f24e9980 ("ceph: OSD client")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

parent b51456a6

net/ceph/osdmap.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -317,6 +317,7 @@ static struct crush_map crush_decode(void pbyval, void *end)
		u32 yes;
		struct crush_rule *r;

		err = -EINVAL;
		ceph_decode_32_safe(p, end, yes, bad);
		if (!yes) {
		dout("crush_decode NO rule %d off %x %p to %p\n",