diff options
| author | Dan Carpenter <[email protected]> | 2017-05-23 14:25:10 +0000 |
|---|---|---|
| committer | Ilya Dryomov <[email protected]> | 2017-05-23 18:32:32 +0000 |
| commit | 293dffaad8d500e1a5336eeb90d544cf40d4fbd8 (patch) | |
| tree | 1eb76ba55a52cc58f21125d01f9b33b6f220c0d5 /fs/jbd2/commit.c | |
| parent | libceph: fix error handling in process_one_ticket() (diff) | |
| download | kernel-293dffaad8d500e1a5336eeb90d544cf40d4fbd8.tar.gz kernel-293dffaad8d500e1a5336eeb90d544cf40d4fbd8.zip | |
libceph: NULL deref on crush_decode() error path
If there is not enough space then ceph_decode_32_safe() does a goto bad.
We need to return an error code in that situation. The current code
returns ERR_PTR(0) which is NULL. The callers are not expecting that
and it results in a NULL dereference.
Fixes: f24e9980eb86 ("ceph: OSD client")
Signed-off-by: Dan Carpenter <[email protected]>
Reviewed-by: Ilya Dryomov <[email protected]>
Signed-off-by: Ilya Dryomov <[email protected]>
Diffstat (limited to 'fs/jbd2/commit.c')
0 files changed, 0 insertions, 0 deletions