linux-kernel - Re: [PATCH v2] net: ceph: make free_choose_arg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <dc95e2dbc1293fe00aea3518443a241b890eef79.camel@ibm.com>
Date: Tue, 23 Dec 2025 23:01:31 +0000
From: Viacheslav Dubeyko <Slava.Dubeyko@....com>
To: "idryomov@...il.com" <idryomov@...il.com>, Xiubo Li <xiubli@...hat.com>,
        "islituo@...il.com" <islituo@...il.com>
CC: "ceph-devel@...r.kernel.org" <ceph-devel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re:  [PATCH v2] net: ceph: make free_choose_arg_map() resilient to
 partial allocation

On Sun, 2025-12-21 at 02:11 +0800, Tuo Li wrote:
> free_choose_arg_map() may dereference a NULL pointer if its caller fails
> after a partial allocation.
> 
> For example, in decode_choose_args(), if allocation of arg_map->args
> fails, execution jumps to the fail label and free_choose_arg_map() is
> called. Since arg_map->size is updated to a non-zero value before memory
> allocation, free_choose_arg_map() will iterate over arg_map->args and
> dereference a NULL pointer.
> 
> To prevent this potential NULL pointer dereference and make
> free_choose_arg_map() more resilient, add checks for pointers before
> iterating.
> 
> Signed-off-by: Tuo Li <islituo@...il.com>
> ---
> v2:
> * Add pointer checks before iterating in free_choose_arg_map(), instead of
>   moving the arg_map->size assignment in decode_choose_args().
>   Thanks to Viacheslav Dubeyko for pointing out the issue with the previous
>   patch, and to Ilya Dryomov for the helpful advice.
> ---
>  net/ceph/osdmap.c | 20 ++++++++++++--------
>  1 file changed, 12 insertions(+), 8 deletions(-)
> 
> diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
> index 34b3ab59602f..08157945af43 100644
> --- a/net/ceph/osdmap.c
> +++ b/net/ceph/osdmap.c
> @@ -241,22 +241,26 @@ static struct crush_choose_arg_map *alloc_choose_arg_map(void)
>  
>  static void free_choose_arg_map(struct crush_choose_arg_map *arg_map)
>  {
> -	if (arg_map) {
> -		int i, j;
> +	int i, j;
> +
> +	if (!arg_map)
> +		return;
>  
> -		WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
> +	WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
>  
> +	if (arg_map->args) {
>  		for (i = 0; i < arg_map->size; i++) {
>  			struct crush_choose_arg *arg = &arg_map->args[i];
> -
> -			for (j = 0; j < arg->weight_set_size; j++)
> -				kfree(arg->weight_set[j].weights);
> -			kfree(arg->weight_set);
> +			if (arg->weight_set) {
> +				for (j = 0; j < arg->weight_set_size; j++)
> +					kfree(arg->weight_set[j].weights);
> +				kfree(arg->weight_set);
> +			}
>  			kfree(arg->ids);
>  		}
>  		kfree(arg_map->args);
> -		kfree(arg_map);
>  	}
> +	kfree(arg_map);
>  }
>  
>  DEFINE_RB_FUNCS(choose_arg_map, struct crush_choose_arg_map, choose_args_index,

Looks good. Thanks a lot for the fix.

Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@....com>

Thanks,
Slava.