* [PATCH] libceph: NULL deref on crush_decode() error path
@ 2017-05-23 14:25 Dan Carpenter
2017-05-23 16:23 ` Ilya Dryomov
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2017-05-23 14:25 UTC (permalink / raw)
To: Ilya Dryomov, Sage Weil; +Cc: Yan, Zheng, ceph-devel, kernel-janitors
If there is not enough space then ceph_decode_32_safe() does a goto bad.
We need to return an error code in that situation. The current code
returns ERR_PTR(0) which is NULL. The callers are not expecting that
and it results in a NULL dereference.
Fixes: f24e9980eb86 ("ceph: OSD client")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index ffe9e904d4d1..55e3a477f92d 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -317,6 +317,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
u32 yes;
struct crush_rule *r;
+ err = -EINVAL;
ceph_decode_32_safe(p, end, yes, bad);
if (!yes) {
dout("crush_decode NO rule %d off %x %p to %p\n",
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] libceph: NULL deref on crush_decode() error path
2017-05-23 14:25 [PATCH] libceph: NULL deref on crush_decode() error path Dan Carpenter
@ 2017-05-23 16:23 ` Ilya Dryomov
0 siblings, 0 replies; 2+ messages in thread
From: Ilya Dryomov @ 2017-05-23 16:23 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Sage Weil, Yan, Zheng, Ceph Development, kernel-janitors
On Tue, May 23, 2017 at 4:25 PM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
> If there is not enough space then ceph_decode_32_safe() does a goto bad.
> We need to return an error code in that situation. The current code
> returns ERR_PTR(0) which is NULL. The callers are not expecting that
> and it results in a NULL dereference.
>
> Fixes: f24e9980eb86 ("ceph: OSD client")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
> index ffe9e904d4d1..55e3a477f92d 100644
> --- a/net/ceph/osdmap.c
> +++ b/net/ceph/osdmap.c
> @@ -317,6 +317,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
> u32 yes;
> struct crush_rule *r;
>
> + err = -EINVAL;
> ceph_decode_32_safe(p, end, yes, bad);
> if (!yes) {
> dout("crush_decode NO rule %d off %x %p to %p\n",
Applied.
Thanks,
Ilya
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-05-23 16:23 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-05-23 14:25 [PATCH] libceph: NULL deref on crush_decode() error path Dan Carpenter
2017-05-23 16:23 ` Ilya Dryomov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox