tree 4ec2beaab50c672c98f49503d79479c29a2cb9e2
parent 9fc2a46aded05d2ed0e9e05f5156fc7c91b49a4b
author Dan Carpenter <dan.carpenter@oracle.com> 1495549510 +0300
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1523641685 +0200

libceph: NULL deref on crush_decode() error path


[ Upstream commit 293dffaad8d500e1a5336eeb90d544cf40d4fbd8 ]

If there is not enough space then ceph_decode_32_safe() does a goto bad.
We need to return an error code in that situation.  The current code
returns ERR_PTR(0) which is NULL.  The callers are not expecting that
and it results in a NULL dereference.

Fixes: f24e9980eb86 ("ceph: OSD client")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>