libceph: make free_choose_arg_map() resilient to partial allocation

commit e3fe30e57649c551757a02e1cad073c47e1e075e upstream.

free_choose_arg_map() may dereference a NULL pointer if its caller fails
after a partial allocation.

For example, in decode_choose_args(), if allocation of arg_map->args
fails, execution jumps to the fail label and free_choose_arg_map() is
called. Since arg_map->size is updated to a non-zero value before memory
allocation, free_choose_arg_map() will iterate over arg_map->args and
dereference a NULL pointer.

To prevent this potential NULL pointer dereference and make
free_choose_arg_map() more resilient, add checks for pointers before
iterating.

Cc: stable@vger.kernel.org
Co-authored-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Tuo Li <islituo@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index ddaf7b4c75645d5add8e03be0a896c60fa3f6e7c..7c7fd397c65028e84eeae402569c821f84dcc1d8 100644 (file)
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -225,22 +225,26 @@ static struct crush_choose_arg_map *alloc_choose_arg_map(void)
 
 static void free_choose_arg_map(struct crush_choose_arg_map *arg_map)
 {
-       if (arg_map) {
-               int i, j;
+       int i, j;
+
+       if (!arg_map)
+               return;
 
-               WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
+       WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
 
+       if (arg_map->args) {
                for (i = 0; i < arg_map->size; i++) {
                        struct crush_choose_arg *arg = &arg_map->args[i];
-
-                       for (j = 0; j < arg->weight_set_size; j++)
-                               kfree(arg->weight_set[j].weights);
-                       kfree(arg->weight_set);
+                       if (arg->weight_set) {
+                               for (j = 0; j < arg->weight_set_size; j++)
+                                       kfree(arg->weight_set[j].weights);
+                               kfree(arg->weight_set);
+                       }
                        kfree(arg->ids);
                }
                kfree(arg_map->args);
-               kfree(arg_map);
        }
+       kfree(arg_map);
 }
 
 DEFINE_RB_FUNCS(choose_arg_map, struct crush_choose_arg_map, choose_args_index,