From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, TOTE Robot <oslab@tsinghua.edu.cn>,
Tuo Li <islituo@gmail.com>, Jeff Layton <jlayton@kernel.org>,
Ilya Dryomov <idryomov@gmail.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.13 12/24] ceph: fix possible null-pointer dereference in ceph_mdsmap_decode()
Date: Mon, 6 Sep 2021 14:55:41 +0200 [thread overview]
Message-ID: <20210906125449.519832490@linuxfoundation.org> (raw)
In-Reply-To: <20210906125449.112564040@linuxfoundation.org>
From: Tuo Li <islituo@gmail.com>
[ Upstream commit a9e6ffbc5b7324b6639ee89028908b1e91ceed51 ]
kcalloc() is called to allocate memory for m->m_info, and if it fails,
ceph_mdsmap_destroy() behind the label out_err will be called:
ceph_mdsmap_destroy(m);
In ceph_mdsmap_destroy(), m->m_info is dereferenced through:
kfree(m->m_info[i].export_targets);
To fix this possible null-pointer dereference, check m->m_info before the
for loop to free m->m_info[i].export_targets.
[ jlayton: fix up whitespace damage
only kfree(m->m_info) if it's non-NULL ]
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Tuo Li <islituo@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mdsmap.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c
index abd9af7727ad..3c444b9cb17b 100644
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -394,9 +394,11 @@ void ceph_mdsmap_destroy(struct ceph_mdsmap *m)
{
int i;
- for (i = 0; i < m->possible_max_rank; i++)
- kfree(m->m_info[i].export_targets);
- kfree(m->m_info);
+ if (m->m_info) {
+ for (i = 0; i < m->possible_max_rank; i++)
+ kfree(m->m_info[i].export_targets);
+ kfree(m->m_info);
+ }
kfree(m->m_data_pg_pools);
kfree(m);
}
--
2.30.2
next prev parent reply other threads:[~2021-09-06 12:58 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-06 12:55 [PATCH 5.13 00/24] 5.13.15-rc1 review Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 01/24] ext4: fix race writing to an inline_data file while its xattrs are changing Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 02/24] ext4: fix e2fsprogs checksum failure for mounted filesystem Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 03/24] gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 04/24] reset: reset-zynqmp: Fixed the argument data type Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 05/24] qed: Fix the VF msix vectors flow Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 06/24] net: dsa: mv88e6xxx: Update mv88e6393x serdes errata Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 07/24] riscv: dts: microchip: Use local-mac-address for emac1 Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 08/24] riscv: dts: microchip: Add ethernet0 to the aliases node Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 09/24] net: macb: Add a NULL check on desc_ptp Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 10/24] qede: Fix memset corruption Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 11/24] perf/x86/intel/pt: Fix mask of num_address_ranges Greg Kroah-Hartman
2021-09-06 12:55 ` Greg Kroah-Hartman [this message]
2021-09-06 12:55 ` [PATCH 5.13 13/24] perf/x86/amd/ibs: Work around erratum #1197 Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 14/24] perf/x86/amd/power: Assign pmu.module Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 15/24] cryptoloop: add a deprecation warning Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 16/24] xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 17/24] USB: serial: pl2303: fix GL type detection Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 18/24] USB: serial: cp210x: fix control-characters error handling Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 19/24] USB: serial: cp210x: fix flow-control " Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 20/24] ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 21/24] ALSA: usb-audio: Fix regression on Sony WALKMAN NW-A45 DAC Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 22/24] ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17 Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 23/24] ALSA: pcm: fix divide error in snd_pcm_lib_ioctl Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.13 24/24] media: stkwebcam: fix memory leak in stk_camera_probe Greg Kroah-Hartman
2021-09-06 17:51 ` [PATCH 5.13 00/24] 5.13.15-rc1 review Fox Chen
2021-09-07 6:43 ` Naresh Kamboju
2021-09-07 16:42 ` Florian Fainelli
2021-09-07 20:07 ` Shuah Khan
2021-09-07 21:36 ` Justin Forbes
2021-09-08 1:20 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210906125449.519832490@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=idryomov@gmail.com \
--cc=islituo@gmail.com \
--cc=jlayton@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=oslab@tsinghua.edu.cn \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).