ceph: fix null pointer dereference

PATCH In review Nathaniel Yazdani 2 participants 2 messages Aug 5, 2013 Ceph client

Share & tools

Nathaniel Yazdani

author

2013-08-05 04:04 UTC #0 lore raw

PATCH 1/1 ceph: fix null pointer dereference

When register_session() is given an out-of-range argument for mds,
ceph_mdsmap_get_addr() will return a null pointer, which would be given to ceph_con_open() & be dereferenced, causing a kernel oops. This fixes bug #4685 in the Ceph bug tracker <http://tracker.ceph.com/issues/4685>.

Signed-off-by Nathaniel Yazdani <[email protected]>

---

fs/ceph/mds_client.c +3 -0

index 187bf21..ddff072 100644
@@ -414,6 +414,9 @@ static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc,
 {
 	struct ceph_mds_session *s;
 
+	if (mds >= mdsc->mdsmap->m_max_mds)
+		return ERR_PTR(-EINVAL);
+
 	s = kzalloc(sizeof(*s), GFP_NOFS);
 	if (!s)
 		return ERR_PTR(-ENOMEM);

Sage Weil

2013-08-05 04:14 UTC #1 lore raw

Looks right, applied to the testing branch.

Thanks!
sage

Quoted 29 lines · Nathaniel Yazdani

When register_session() is given an out-of-range argument for mds,
ceph_mdsmap_get_addr() will return a null pointer, which would be given to ceph_con_open() & be dereferenced, causing a kernel oops. This fixes bug #4685 in the Ceph bug tracker <http://tracker.ceph.com/issues/4685>.
Signed-off-by Nathaniel Yazdani <[email protected]>
---
fs/ceph/mds_client.c +3 -1
index 187bf21..ddff072 100644
@@ -414,6 +414,9 @@ static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc,
 {
 	struct ceph_mds_session *s;
 
+	if (mds >= mdsc->mdsmap->m_max_mds)
+		return ERR_PTR(-EINVAL);
+
 	s = kzalloc(sizeof(*s), GFP_NOFS);
 	if (!s)
 		return ERR_PTR(-ENOMEM);
 
 
--
To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html