net: ceph: make free_choose_arg_map() resilient to partial allocation

[PATCH v2] net: ceph: make free_choose_arg_map() resilient to partial allocation

Posted by Tuo Li 1 month, 2 weeks ago

free_choose_arg_map() may dereference a NULL pointer if its caller fails
after a partial allocation.

For example, in decode_choose_args(), if allocation of arg_map->args
fails, execution jumps to the fail label and free_choose_arg_map() is
called. Since arg_map->size is updated to a non-zero value before memory
allocation, free_choose_arg_map() will iterate over arg_map->args and
dereference a NULL pointer.

To prevent this potential NULL pointer dereference and make
free_choose_arg_map() more resilient, add checks for pointers before
iterating.

Signed-off-by: Tuo Li <islituo@gmail.com>
---
v2:
* Add pointer checks before iterating in free_choose_arg_map(), instead of
  moving the arg_map->size assignment in decode_choose_args().
  Thanks to Viacheslav Dubeyko for pointing out the issue with the previous
  patch, and to Ilya Dryomov for the helpful advice.
---
 net/ceph/osdmap.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 34b3ab59602f..08157945af43 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -241,22 +241,26 @@ static struct crush_choose_arg_map *alloc_choose_arg_map(void)
 
 static void free_choose_arg_map(struct crush_choose_arg_map *arg_map)
 {
-	if (arg_map) {
-		int i, j;
+	int i, j;
+
+	if (!arg_map)
+		return;
 
-		WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
+	WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
 
+	if (arg_map->args) {
 		for (i = 0; i < arg_map->size; i++) {
 			struct crush_choose_arg *arg = &arg_map->args[i];
-
-			for (j = 0; j < arg->weight_set_size; j++)
-				kfree(arg->weight_set[j].weights);
-			kfree(arg->weight_set);
+			if (arg->weight_set) {
+				for (j = 0; j < arg->weight_set_size; j++)
+					kfree(arg->weight_set[j].weights);
+				kfree(arg->weight_set);
+			}
 			kfree(arg->ids);
 		}
 		kfree(arg_map->args);
-		kfree(arg_map);
 	}
+	kfree(arg_map);
 }
 
 DEFINE_RB_FUNCS(choose_arg_map, struct crush_choose_arg_map, choose_args_index,
-- 
2.48.1

Re: [PATCH v2] net: ceph: make free_choose_arg_map() resilient to partial allocation

Posted by Viacheslav Dubeyko 1 month, 2 weeks ago

On Sun, 2025-12-21 at 02:11 +0800, Tuo Li wrote:
> free_choose_arg_map() may dereference a NULL pointer if its caller fails
> after a partial allocation.
> 
> For example, in decode_choose_args(), if allocation of arg_map->args
> fails, execution jumps to the fail label and free_choose_arg_map() is
> called. Since arg_map->size is updated to a non-zero value before memory
> allocation, free_choose_arg_map() will iterate over arg_map->args and
> dereference a NULL pointer.
> 
> To prevent this potential NULL pointer dereference and make
> free_choose_arg_map() more resilient, add checks for pointers before
> iterating.
> 
> Signed-off-by: Tuo Li <islituo@gmail.com>
> ---
> v2:
> * Add pointer checks before iterating in free_choose_arg_map(), instead of
>   moving the arg_map->size assignment in decode_choose_args().
>   Thanks to Viacheslav Dubeyko for pointing out the issue with the previous
>   patch, and to Ilya Dryomov for the helpful advice.
> ---
>  net/ceph/osdmap.c | 20 ++++++++++++--------
>  1 file changed, 12 insertions(+), 8 deletions(-)
> 
> diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
> index 34b3ab59602f..08157945af43 100644
> --- a/net/ceph/osdmap.c
> +++ b/net/ceph/osdmap.c
> @@ -241,22 +241,26 @@ static struct crush_choose_arg_map *alloc_choose_arg_map(void)
>  
>  static void free_choose_arg_map(struct crush_choose_arg_map *arg_map)
>  {
> -	if (arg_map) {
> -		int i, j;
> +	int i, j;
> +
> +	if (!arg_map)
> +		return;
>  
> -		WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
> +	WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
>  
> +	if (arg_map->args) {
>  		for (i = 0; i < arg_map->size; i++) {
>  			struct crush_choose_arg *arg = &arg_map->args[i];
> -
> -			for (j = 0; j < arg->weight_set_size; j++)
> -				kfree(arg->weight_set[j].weights);
> -			kfree(arg->weight_set);
> +			if (arg->weight_set) {
> +				for (j = 0; j < arg->weight_set_size; j++)
> +					kfree(arg->weight_set[j].weights);
> +				kfree(arg->weight_set);
> +			}
>  			kfree(arg->ids);
>  		}
>  		kfree(arg_map->args);
> -		kfree(arg_map);
>  	}
> +	kfree(arg_map);
>  }
>  
>  DEFINE_RB_FUNCS(choose_arg_map, struct crush_choose_arg_map, choose_args_index,

Looks good. Thanks a lot for the fix.

Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>

Thanks,
Slava.

Re: [PATCH v2] net: ceph: make free_choose_arg_map() resilient to partial allocation

Posted by Ilya Dryomov 1 month ago

On Wed, Dec 24, 2025 at 12:01 AM Viacheslav Dubeyko
<Slava.Dubeyko@ibm.com> wrote:
>
> On Sun, 2025-12-21 at 02:11 +0800, Tuo Li wrote:
> > free_choose_arg_map() may dereference a NULL pointer if its caller fails
> > after a partial allocation.
> >
> > For example, in decode_choose_args(), if allocation of arg_map->args
> > fails, execution jumps to the fail label and free_choose_arg_map() is
> > called. Since arg_map->size is updated to a non-zero value before memory
> > allocation, free_choose_arg_map() will iterate over arg_map->args and
> > dereference a NULL pointer.
> >
> > To prevent this potential NULL pointer dereference and make
> > free_choose_arg_map() more resilient, add checks for pointers before
> > iterating.
> >
> > Signed-off-by: Tuo Li <islituo@gmail.com>
> > ---
> > v2:
> > * Add pointer checks before iterating in free_choose_arg_map(), instead of
> >   moving the arg_map->size assignment in decode_choose_args().
> >   Thanks to Viacheslav Dubeyko for pointing out the issue with the previous
> >   patch, and to Ilya Dryomov for the helpful advice.
> > ---
> >  net/ceph/osdmap.c | 20 ++++++++++++--------
> >  1 file changed, 12 insertions(+), 8 deletions(-)
> >
> > diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
> > index 34b3ab59602f..08157945af43 100644
> > --- a/net/ceph/osdmap.c
> > +++ b/net/ceph/osdmap.c
> > @@ -241,22 +241,26 @@ static struct crush_choose_arg_map *alloc_choose_arg_map(void)
> >
> >  static void free_choose_arg_map(struct crush_choose_arg_map *arg_map)
> >  {
> > -     if (arg_map) {
> > -             int i, j;
> > +     int i, j;
> > +
> > +     if (!arg_map)
> > +             return;
> >
> > -             WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
> > +     WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
> >
> > +     if (arg_map->args) {
> >               for (i = 0; i < arg_map->size; i++) {
> >                       struct crush_choose_arg *arg = &arg_map->args[i];
> > -
> > -                     for (j = 0; j < arg->weight_set_size; j++)
> > -                             kfree(arg->weight_set[j].weights);
> > -                     kfree(arg->weight_set);
> > +                     if (arg->weight_set) {
> > +                             for (j = 0; j < arg->weight_set_size; j++)
> > +                                     kfree(arg->weight_set[j].weights);
> > +                             kfree(arg->weight_set);
> > +                     }
> >                       kfree(arg->ids);
> >               }
> >               kfree(arg_map->args);
> > -             kfree(arg_map);
> >       }
> > +     kfree(arg_map);
> >  }
> >
> >  DEFINE_RB_FUNCS(choose_arg_map, struct crush_choose_arg_map, choose_args_index,
>
> Looks good. Thanks a lot for the fix.
>
> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
>
> Thanks,
> Slava.

Applied.

Thanks,

                Ilya