lkml.org 
[lkml]   [2017]   [Nov]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 022/294] libceph: potential NULL dereference in ceph_msg_data_create()
    3.16.50-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit 7c40b22f6f84c98a1d36e6d0a4346e58f05e45d8 upstream.

    If kmem_cache_zalloc() returns NULL then the INIT_LIST_HEAD(&data->links);
    will Oops. The callers aren't really prepared for NULL returns so it
    doesn't make a lot of difference in real life.

    Fixes: 5240d9f95dfe ("libceph: replace message data pointer with list")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/ceph/messenger.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    --- a/net/ceph/messenger.c
    +++ b/net/ceph/messenger.c
    @@ -3075,8 +3075,10 @@ static struct ceph_msg_data *ceph_msg_da
    return NULL;

    data = kmem_cache_zalloc(ceph_msg_data_cache, GFP_NOFS);
    - if (data)
    - data->type = type;
    + if (!data)
    + return NULL;
    +
    + data->type = type;
    INIT_LIST_HEAD(&data->links);

    return data;
    \
     
     \ /
      Last update: 2017-11-08 20:59    [W:4.087 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site