libceph: make free_choose_arg_map() resilient to partial allocation

free_choose_arg_map() may dereference a NULL pointer if its caller fails
after a partial allocation.

For example, in decode_choose_args(), if allocation of arg_map->args
fails, execution jumps to the fail label and free_choose_arg_map() is
called. Since arg_map->size is updated to a non-zero value before memory
allocation, free_choose_arg_map() will iterate over arg_map->args and
dereference a NULL pointer.

To prevent this potential NULL pointer dereference and make
free_choose_arg_map() more resilient, add checks for pointers before
iterating.

Cc: stable@vger.kernel.org
Co-authored-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Tuo Li <islituo@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 3377a22e3f6c1a26213fc67b9b833b53c046eeb8..92a44026de293400ffd178242d72e5cc79f32e30 100644 (file)
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -241,22 +241,26 @@ static struct crush_choose_arg_map *alloc_choose_arg_map(void)
 
 static void free_choose_arg_map(struct crush_choose_arg_map *arg_map)
 {
-       if (arg_map) {
-               int i, j;
+       int i, j;
+
+       if (!arg_map)
+               return;
 
-               WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
+       WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
 
+       if (arg_map->args) {
                for (i = 0; i < arg_map->size; i++) {
                        struct crush_choose_arg *arg = &arg_map->args[i];
-
-                       for (j = 0; j < arg->weight_set_size; j++)
-                               kfree(arg->weight_set[j].weights);
-                       kfree(arg->weight_set);
+                       if (arg->weight_set) {
+                               for (j = 0; j < arg->weight_set_size; j++)
+                                       kfree(arg->weight_set[j].weights);
+                               kfree(arg->weight_set);
+                       }
                        kfree(arg->ids);
                }
                kfree(arg_map->args);
-               kfree(arg_map);
        }
+       kfree(arg_map);
 }
 
 DEFINE_RB_FUNCS(choose_arg_map, struct crush_choose_arg_map, choose_args_index,