libceph: NULL deref on crush_decode() error path
If there is not enough space then ceph_decode_32_safe() does a goto bad. We need to return an error code in that situation. The current code returns ERR_PTR(0) which is NULL. The callers are not expecting that and it results in a NULL dereference. Fixes: f24e9980eb86 ("ceph: OSD client") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
This commit is contained in:
parent
b51456a609
commit
293dffaad8
@ -317,6 +317,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
|
||||
u32 yes;
|
||||
struct crush_rule *r;
|
||||
|
||||
err = -EINVAL;
|
||||
ceph_decode_32_safe(p, end, yes, bad);
|
||||
if (!yes) {
|
||||
dout("crush_decode NO rule %d off %x %p to %p\n",
|
||||
|
Loading…
x
Reference in New Issue
Block a user