linux-kernel - Re: [PATCH v2] net: ceph: make free_choose_arg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAOi1vP9KpasJHGdb78NpboQ1sgkfVNqZ+s-cXVnoho4J52KkqA@mail.gmail.com>
Date: Mon, 5 Jan 2026 13:53:49 +0100
From: Ilya Dryomov <idryomov@...il.com>
To: Viacheslav Dubeyko <Slava.Dubeyko@....com>
Cc: Xiubo Li <xiubli@...hat.com>, "islituo@...il.com" <islituo@...il.com>, 
	"ceph-devel@...r.kernel.org" <ceph-devel@...r.kernel.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] net: ceph: make free_choose_arg_map() resilient to
 partial allocation

On Wed, Dec 24, 2025 at 12:01 AM Viacheslav Dubeyko
<Slava.Dubeyko@....com> wrote:
>
> On Sun, 2025-12-21 at 02:11 +0800, Tuo Li wrote:
> > free_choose_arg_map() may dereference a NULL pointer if its caller fails
> > after a partial allocation.
> >
> > For example, in decode_choose_args(), if allocation of arg_map->args
> > fails, execution jumps to the fail label and free_choose_arg_map() is
> > called. Since arg_map->size is updated to a non-zero value before memory
> > allocation, free_choose_arg_map() will iterate over arg_map->args and
> > dereference a NULL pointer.
> >
> > To prevent this potential NULL pointer dereference and make
> > free_choose_arg_map() more resilient, add checks for pointers before
> > iterating.
> >
> > Signed-off-by: Tuo Li <islituo@...il.com>
> > ---
> > v2:
> > * Add pointer checks before iterating in free_choose_arg_map(), instead of
> >   moving the arg_map->size assignment in decode_choose_args().
> >   Thanks to Viacheslav Dubeyko for pointing out the issue with the previous
> >   patch, and to Ilya Dryomov for the helpful advice.
> > ---
> >  net/ceph/osdmap.c | 20 ++++++++++++--------
> >  1 file changed, 12 insertions(+), 8 deletions(-)
> >
> > diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
> > index 34b3ab59602f..08157945af43 100644
> > --- a/net/ceph/osdmap.c
> > +++ b/net/ceph/osdmap.c
> > @@ -241,22 +241,26 @@ static struct crush_choose_arg_map *alloc_choose_arg_map(void)
> >
> >  static void free_choose_arg_map(struct crush_choose_arg_map *arg_map)
> >  {
> > -     if (arg_map) {
> > -             int i, j;
> > +     int i, j;
> > +
> > +     if (!arg_map)
> > +             return;
> >
> > -             WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
> > +     WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
> >
> > +     if (arg_map->args) {
> >               for (i = 0; i < arg_map->size; i++) {
> >                       struct crush_choose_arg *arg = &arg_map->args[i];
> > -
> > -                     for (j = 0; j < arg->weight_set_size; j++)
> > -                             kfree(arg->weight_set[j].weights);
> > -                     kfree(arg->weight_set);
> > +                     if (arg->weight_set) {
> > +                             for (j = 0; j < arg->weight_set_size; j++)
> > +                                     kfree(arg->weight_set[j].weights);
> > +                             kfree(arg->weight_set);
> > +                     }
> >                       kfree(arg->ids);
> >               }
> >               kfree(arg_map->args);
> > -             kfree(arg_map);
> >       }
> > +     kfree(arg_map);
> >  }
> >
> >  DEFINE_RB_FUNCS(choose_arg_map, struct crush_choose_arg_map, choose_args_index,
>
> Looks good. Thanks a lot for the fix.
>
> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@....com>
>
> Thanks,
> Slava.

Applied.

Thanks,

                Ilya