Dan Carpenter 23ae585a2f libceph: NULL deref on crush_decode() error path ...

[ Upstream commit 293dffaad8 ]

If there is not enough space then ceph_decode_32_safe() does a goto bad.
We need to return an error code in that situation.  The current code
returns ERR_PTR(0) which is NULL.  The callers are not expecting that
and it results in a NULL dereference.

Fixes: f24e9980eb ("ceph: OSD client")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-04-13 19:50:10 +02:00

..

crush

crush: sync up with userspace

2015-06-25 11:49:31 +03:00

armor.c

…

auth_none.c

libceph: Fix NULL pointer dereference in auth client code

2013-07-03 15:32:55 -07:00

auth_none.h

net: 8021q/bluetooth/bridge/can/ceph: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

auth_x_protocol.h

…

auth_x.c

libceph: add nocephx_sign_messages option

2015-11-02 23:37:46 +01:00

auth_x.h

libceph: store session key in cephx authorizer

2014-12-17 20:09:50 +03:00

auth.c

libceph: wrap auth methods in a mutex

2013-05-01 21:17:15 -07:00

buffer.c

libceph: nuke ceph_kvfree()

2014-12-17 20:09:50 +03:00

ceph_common.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client

2015-11-13 09:24:40 -08:00

ceph_fs.c

…

ceph_hash.c

…

ceph_strings.c

libceph: nuke pool op infrastructure

2015-02-19 13:31:37 +03:00

crypto.c

KEYS: Merge the type-specific data with the payload data

2015-10-21 15:18:36 +01:00

crypto.h

libceph: introduce ceph_x_authorizer_cleanup()

2015-11-02 23:36:48 +01:00

debugfs.c

libceph: expose client options through debugfs

2015-04-20 18:55:39 +03:00

Kconfig

libceph: select CRYPTO_CBC in addition to CRYPTO_AES

2014-10-14 21:03:20 +04:00

Makefile

libceph: create source file "net/ceph/snapshot.c"

2013-05-01 21:20:08 -07:00

messenger.c

libceph: force GFP_NOIO for socket allocations

2017-04-08 09:53:30 +02:00

mon_client.c

libceph: use keepalive2 to verify the mon session is alive

2015-09-08 23:14:30 +03:00

msgpool.c

…

osd_client.c

libceph: don't spam dmesg with stray reply warnings

2016-03-03 15:07:26 -08:00

osdmap.c

libceph: NULL deref on crush_decode() error path

2018-04-13 19:50:10 +02:00

pagelist.c

libceph: reference counting pagelist

2014-10-14 12:56:48 -07:00

pagevec.c

libceph: use kvfree() instead of open-coding it

2015-06-25 11:49:28 +03:00

snapshot.c

libceph: create source file "net/ceph/snapshot.c"

2013-05-01 21:20:08 -07:00