On Tue, May 23, 2017 at 4:25 PM, Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> If there is not enough space then ceph_decode_32_safe() does a goto bad.
> We need to return an error code in that situation. The current code
> returns ERR_PTR(0) which is NULL. The callers are not expecting that
> and it results in a NULL dereference.
>
> Fixes: f24e9980eb86 ("ceph: OSD client")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
>
> diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
> index ffe9e904d4d1..55e3a477f92d 100644
> --- a/net/ceph/osdmap.c
> +++ b/net/ceph/osdmap.c
> @@ -317,6 +317,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
> u32 yes;
> struct crush_rule *r;
>
> + err = -EINVAL;
> ceph_decode_32_safe(p, end, yes, bad);
> if (!yes) {
> dout("crush_decode NO rule %d off %x %p to %p\n",
Applied.
Thanks,
Ilya
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
