diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2017-05-23 17:25:10 +0300 |
|---|---|---|
| committer |   Ilya Dryomov <idryomov@gmail.com> | 2017-05-23 20:32:32 +0200 |
| commit | 293dffaad8d500e1a5336eeb90d544cf40d4fbd8 (patch) | |
| tree | 1eb76ba55a52cc58f21125d01f9b33b6f220c0d5 /net/ceph/messenger.c | |
| parent | libceph: fix error handling in process_one_ticket() (diff) | |
| download | linux-dev-293dffaad8d500e1a5336eeb90d544cf40d4fbd8.tar.xz linux-dev-293dffaad8d500e1a5336eeb90d544cf40d4fbd8.zip | |
libceph: NULL deref on crush_decode() error path
If there is not enough space then ceph_decode_32_safe() does a goto bad.
We need to return an error code in that situation. The current code
returns ERR_PTR(0) which is NULL. The callers are not expecting that
and it results in a NULL dereference.
Fixes: f24e9980eb86 ("ceph: OSD client")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions