Dan Carpenter af0b6ca74b libceph: NULL deref on crush_decode() error path ...

commit 293dffaad8 upstream.

If there is not enough space then ceph_decode_32_safe() does a goto bad.
We need to return an error code in that situation.  The current code
returns ERR_PTR(0) which is NULL.  The callers are not expecting that
and it results in a NULL dereference.

Fixes: f24e9980eb ("ceph: OSD client")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

2017-09-15 18:30:47 +01:00

..

crush

…

armor.c

…

auth_none.c

…

auth_none.h

…

auth_x_protocol.h

…

auth_x.c

libceph: do not hard code max auth ticket len

2014-11-05 20:27:42 +00:00

auth_x.h

…

auth.c

…

buffer.c

…

ceph_common.c

…

ceph_fs.c

…

ceph_hash.c

…

ceph_strings.c

…

crypto.c

libceph: do not crash on large auth tickets

2014-12-14 16:23:56 +00:00

crypto.h

…

debugfs.c

…

Kconfig

…

Makefile

…

messenger.c

libceph: verify authorize reply on connect

2017-03-16 02:18:31 +00:00

mon_client.c

libceph: gracefully handle large reply messages from the mon

2014-11-05 20:27:42 +00:00

msgpool.c

…

osd_client.c

libceph: fix double __remove_osd() problem

2015-05-09 23:16:19 +01:00

osdmap.c

libceph: NULL deref on crush_decode() error path

2017-09-15 18:30:47 +01:00

pagelist.c

…

pagevec.c

…