From patchwork Sun Sep 7 10:10:51 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: roy.qing.li@gmail.com X-Patchwork-Id: 4858411 Return-Path: X-Original-To: patchwork-ceph-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id DA2EFC0338 for ; Sun, 7 Sep 2014 10:11:02 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 10E182010F for ; Sun, 7 Sep 2014 10:11:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 32038200E7 for ; Sun, 7 Sep 2014 10:11:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751218AbaIGKK4 (ORCPT ); Sun, 7 Sep 2014 06:10:56 -0400 Received: from mail-pa0-f41.google.com ([209.85.220.41]:55880 "EHLO mail-pa0-f41.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750876AbaIGKKz (ORCPT ); Sun, 7 Sep 2014 06:10:55 -0400 Received: by mail-pa0-f41.google.com with SMTP id lf10so3314987pab.14 for ; Sun, 07 Sep 2014 03:10:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:message-id; bh=z04j42WBw90jOEGDcjdXelqMl4QMh5r0cmn3AMrtw/g=; b=LUMCcXSZOz4yNfFpyY3IKcZQAwP64hO4hH4MmWrCN6t1aru2qPPFfzqDlPCxtuR7wa EK1L8yM9HLHCthRpXbXH/Gb06ILpAUrTtWtwIp/Pfdje9Vuqj4FQ9W2vIG12PsO5VCZP qkh9pRoh3aWIyuE1X5FCgtgV8l/etTPH5ZERIKWhgaGtYYM9XjYG18Dmn+Kunuy2ilCq V1kMSjxLeObnr2PhObKnZm28WAjtrIA6fSCdMTdCyJ9Q8U2qe0IcELPYa3/mygg/62Zh HE4Y5qlNGbLiyTOnIzrgQ1sg9Pfh7Bu6whbsdtEILDC43o4M+FQbN6EMK0usUQG1umeH XV9w== X-Received: by 10.68.132.225 with SMTP id ox1mr10673745pbb.99.1410084654908; Sun, 07 Sep 2014 03:10:54 -0700 (PDT) Received: from localhost ([1.202.252.122]) by mx.google.com with ESMTPSA id fk11sm6163917pdb.91.2014.09.07.03.10.53 for (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Sun, 07 Sep 2014 03:10:54 -0700 (PDT) From: roy.qing.li@gmail.com To: ceph-devel@vger.kernel.org, sage@inktank.com Subject: [PATCH] libceph: fix a use after free issue in osdmap_set_max_osd Date: Sun, 7 Sep 2014 18:10:51 +0800 Message-Id: <1410084652-23031-1-git-send-email-roy.qing.li@gmail.com> X-Mailer: git-send-email 1.7.10.4 Sender: ceph-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: ceph-devel@vger.kernel.org X-Spam-Status: No, score=-8.4 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Li RongQing If the state variable is krealloced successfully, map->osd_state will be freed, once following two reallocation failed, and exit the function without resetting map->osd_state, map->osd_state become a wild pointer. fix it by resetting them after krealloc successfully. Signed-off-by: Li RongQing --- net/ceph/osdmap.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c index c547e46..81e9c66 100644 --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -671,15 +671,19 @@ static int osdmap_set_max_osd(struct ceph_osdmap *map, int max) int i; state = krealloc(map->osd_state, max*sizeof(*state), GFP_NOFS); + if (!state) + return -ENOMEM; + map->osd_state = state; + weight = krealloc(map->osd_weight, max*sizeof(*weight), GFP_NOFS); - addr = krealloc(map->osd_addr, max*sizeof(*addr), GFP_NOFS); - if (!state || !weight || !addr) { - kfree(state); - kfree(weight); - kfree(addr); + if (!weight) + return -ENOMEM; + map->osd_weight = weight; + addr = krealloc(map->osd_addr, max*sizeof(*addr), GFP_NOFS); + if (!addr) return -ENOMEM; - } + map->osd_addr = addr; for (i = map->max_osd; i < max; i++) { state[i] = 0; @@ -687,10 +691,6 @@ static int osdmap_set_max_osd(struct ceph_osdmap *map, int max) memset(addr + i, 0, sizeof(*addr)); } - map->osd_state = state; - map->osd_weight = weight; - map->osd_addr = addr; - if (map->osd_primary_affinity) { u32 *affinity;