summaryrefslogtreecommitdiffstats
path: root/net/ceph
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2017-05-23 17:25:10 +0300
committerIlya Dryomov <idryomov@gmail.com>2017-05-23 20:32:32 +0200
commit293dffaad8d500e1a5336eeb90d544cf40d4fbd8 (patch)
tree1eb76ba55a52cc58f21125d01f9b33b6f220c0d5 /net/ceph
parentb51456a6096ebf9f4ceb2cc7e176b471d4b70af0 (diff)
downloadlinux-293dffaad8d500e1a5336eeb90d544cf40d4fbd8.tar.bz2
libceph: NULL deref on crush_decode() error path
If there is not enough space then ceph_decode_32_safe() does a goto bad. We need to return an error code in that situation. The current code returns ERR_PTR(0) which is NULL. The callers are not expecting that and it results in a NULL dereference. Fixes: f24e9980eb86 ("ceph: OSD client") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'net/ceph')
-rw-r--r--net/ceph/osdmap.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index ffe9e904d4d1..55e3a477f92d 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -317,6 +317,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
u32 yes;
struct crush_rule *r;
+ err = -EINVAL;
ceph_decode_32_safe(p, end, yes, bad);
if (!yes) {
dout("crush_decode NO rule %d off %x %p to %p\n",