libceph: NULL deref on crush_decode() error path

If there is not enough space then ceph_decode_32_safe() does a goto bad. We need to return an error code in that situation. The current code returns ERR_PTR(0) which is NULL. The callers are not expecting that and it results in a NULL dereference. Fixes: f24e998 ("ceph: OSD client") Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Ilya Dryomov <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]>
chewitt · May 23, 2017 · 293dffa · 293dffa
1 parent b51456a
commit 293dffa
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
@@ -317,6 +317,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
 		u32 yes;
 		struct crush_rule *r;
 
+		err = -EINVAL;
 		ceph_decode_32_safe(p, end, yes, bad);
 		if (!yes) {
 			dout("crush_decode NO rule %d off %x %p to %p\n",