Commit e3fe30e5 authored Dec 21, 2025 by Tuo Li Committed by Ilya Dryomov Jan 05, 2026

libceph: make free_choose_arg_map() resilient to partial allocation



free_choose_arg_map() may dereference a NULL pointer if its caller fails
after a partial allocation.

For example, in decode_choose_args(), if allocation of arg_map->args
fails, execution jumps to the fail label and free_choose_arg_map() is
called. Since arg_map->size is updated to a non-zero value before memory
allocation, free_choose_arg_map() will iterate over arg_map->args and
dereference a NULL pointer.

To prevent this potential NULL pointer dereference and make
free_choose_arg_map() more resilient, add checks for pointers before
iterating.

Cc: stable@vger.kernel.org
Co-authored-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Tuo Li <islituo@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

parent bc417a4b

net/ceph/osdmap.c

+12 −8

Original line number	Diff line number	Diff line
		@@ -241,22 +241,26 @@ static struct crush_choose_arg_map *alloc_choose_arg_map(void)

		static void free_choose_arg_map(struct crush_choose_arg_map *arg_map)
		{
		if (arg_map) {
		int i, j;

		if (!arg_map)
		return;

		WARN_ON(!RB_EMPTY_NODE(&arg_map->node));

		if (arg_map->args) {
		for (i = 0; i < arg_map->size; i++) {
		struct crush_choose_arg *arg = &arg_map->args[i];

		if (arg->weight_set) {
		for (j = 0; j < arg->weight_set_size; j++)
		kfree(arg->weight_set[j].weights);
		kfree(arg->weight_set);
		}
		kfree(arg->ids);
		}
		kfree(arg_map->args);
		kfree(arg_map);
		}
		kfree(arg_map);
		}

		DEFINE_RB_FUNCS(choose_arg_map, struct crush_choose_arg_map, choose_args_index,