[patch 1/2] ceph: null deref on allocation failure

[patch 1/2] ceph: null deref on allocation failure

[Dan Carpenter]

The original code checked "event_work" for allocation failures, but only
after it had already use it.

Signed-off-by: Dan Carpenter <error27@gmail.com>

diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 02212ed..b6776cb 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1602,11 +1602,11 @@ void handle_watch_notify(struct ceph_osd_client *osdc, struct ceph_msg *msg)
 	     cookie, ver, event);
 	if (event) {
 		event_work = kmalloc(sizeof(*event_work), GFP_NOIO);
-		INIT_WORK(&event_work->work, do_event_work);
 		if (!event_work) {
 			dout("ERROR: could not allocate event_work\n");
 			goto done_err;
 		}
+		INIT_WORK(&event_work->work, do_event_work);
 		event_work->event = event;
 		event_work->ver = ver;
 		event_work->notify_id = notify_id;

Re: [patch 1/2] ceph: null deref on allocation failure

[Yehuda Sadeh Weinraub]

On Mon, Mar 28, 2011 at 8:25 PM, Dan Carpenter <error27@gmail.com> wrote:
>
> The original code checked "event_work" for allocation failures, but only
> after it had already use it.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
>
> diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
> index 02212ed..b6776cb 100644
> --- a/net/ceph/osd_client.c
> +++ b/net/ceph/osd_client.c
> @@ -1602,11 +1602,11 @@ void handle_watch_notify(struct ceph_osd_client *osdc, struct ceph_msg *msg)
>             cookie, ver, event);
>        if (event) {
>                event_work = kmalloc(sizeof(*event_work), GFP_NOIO);
> -               INIT_WORK(&event_work->work, do_event_work);
>                if (!event_work) {
>                        dout("ERROR: could not allocate event_work\n");
>                        goto done_err;
>                }
> +               INIT_WORK(&event_work->work, do_event_work);
>                event_work->event = event;
>                event_work->ver = ver;
>                event_work->notify_id = notify_id;
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Thanks.

This is already fixed in the latest master branch and will be sent to
Linus soon.

Yehuda
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html