Commit 5199c125 authored by Raphael Zimmer's avatar Raphael Zimmer Committed by Ilya Dryomov
Browse files

libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()



If a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both
protocol and result, this is currently not treated as an error. In case
of ac->negotiating == true and ac->protocol > 0, this leads to setting
ac->protocol = 0 and ac->ops = NULL. Thereafter, the check for
ac->protocol != protocol returns false, and init_protocol() is not
called. Subsequently, ac->ops->handle_reply() is called, which leads to
a null pointer dereference, because ac->ops is still NULL.

This patch changes the check for ac->protocol != protocol to
!ac->protocol, as this also includes the case when the protocol was set
to zero in the message. This causes the message to be treated as
containing a bad auth protocol.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarRaphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Reviewed-by: default avatarIlya Dryomov <idryomov@gmail.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent 028ef9c9
Loading
Loading
Loading
Loading
+1 −1
Original line number Diff line number Diff line
@@ -245,7 +245,7 @@ int ceph_handle_auth_reply(struct ceph_auth_client *ac,
			ac->protocol = 0;
			ac->ops = NULL;
		}
		if (ac->protocol != protocol) {
		if (!ac->protocol) {
			ret = init_protocol(ac, protocol);
			if (ret) {
				pr_err("auth protocol '%s' init failed: %d\n",