| Message ID | 20210805122015.129824-1-islituo@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | ceph: fix possible null-pointer dereference in ceph_mdsmap_decode() | expand |
diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c index abd9af7727ad..7d73e4b64b12 100644 --- a/fs/ceph/mdsmap.c +++ b/fs/ceph/mdsmap.c @@ -166,8 +166,10 @@ struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end, bool msgr2) m->possible_max_rank = max(m->m_num_active_mds, m->m_max_mds); m->m_info = kcalloc(m->possible_max_rank, sizeof(*m->m_info), GFP_NOFS); - if (!m->m_info) - goto nomem; + if (!m->m_info) { + kfree(m); + return ERR_PTR(-ENOMEM); + } /* pick out active nodes from mds_info (state > 0) */ for (i = 0; i < n; i++) {
kcalloc() is called to allocate memory for m->m_info, and if it fails, ceph_mdsmap_destroy() behind the label out_err will be called: ceph_mdsmap_destroy(m); In ceph_mdsmap_destroy(), m->m_info is dereferenced through: kfree(m->m_info[i].export_targets); To fix this possible null-pointer dereference, if memory allocation for m->m_info fails, free m and return -ENOMEM. Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Tuo Li <islituo@gmail.com> --- fs/ceph/mdsmap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)