Commit 7c40b22f authored Jul 17, 2017 by Dan Carpenter Committed by Ilya Dryomov Jul 17, 2017

libceph: potential NULL dereference in ceph_msg_data_create()



If kmem_cache_zalloc() returns NULL then the INIT_LIST_HEAD(&data->links);
will Oops.  The callers aren't really prepared for NULL returns so it
doesn't make a lot of difference in real life.

Fixes: 5240d9f9 ("libceph: replace message data pointer with list")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

parent 84583cfb

net/ceph/messenger.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -3203,7 +3203,9 @@ static struct ceph_msg_data *ceph_msg_data_create(enum ceph_msg_data_type type)
		return NULL;

		data = kmem_cache_zalloc(ceph_msg_data_cache, GFP_NOFS);
		if (data)
		if (!data)
		return NULL;

		data->type = type;
		INIT_LIST_HEAD(&data->links);