]> git.apps.os.sepia.ceph.com Git - ceph.git/commitdiff
Objecter: potential null pointer access in list_(n)objects.
authorxiexingguo <258156334@qq.com>
Wed, 18 Nov 2015 09:57:17 +0000 (17:57 +0800)
committerxiexingguo <xie.xingguo@zte.com.cn>
Sun, 20 Dec 2015 09:35:05 +0000 (17:35 +0800)
In list_objects and list_nobjects, we are possibly access a null returned pointer from the osdmap->get_pg_pool() call.
Fixes: #13822
Signed-off-by: xie xingguo <xie.xingguo@zte.com.cn>
src/osdc/Objecter.cc

index 4bfa8f0080f0c0b1d35b062f91e7f63a3eb27a0d..d01dc9d9561f419577c76cbacf16730a8ae6ea24 100644 (file)
@@ -3372,13 +3372,18 @@ void Objecter::list_nobjects(NListContext *list_context, Context *onfinish)
     // release the listing context's budget once all
     // OPs (in the session) are finished
     put_nlist_context_budget(list_context);
-
     onfinish->complete(0);
     return;
   }
 
   rwlock.get_read();
   const pg_pool_t *pool = osdmap->get_pg_pool(list_context->pool_id);
+  if (!pool) { // pool is gone
+    rwlock.unlock();
+    put_nlist_context_budget(list_context);
+    onfinish->complete(-ENOENT);
+    return;
+  }
   int pg_num = pool->get_pg_num();
   rwlock.unlock();
 
@@ -3523,13 +3528,18 @@ void Objecter::list_objects(ListContext *list_context, Context *onfinish)
     // release the listing context's budget once all
     // OPs (in the session) are finished
     put_list_context_budget(list_context);
-
     onfinish->complete(0);
     return;
   }
 
   rwlock.get_read();
   const pg_pool_t *pool = osdmap->get_pg_pool(list_context->pool_id);
+  if (!pool) { // pool is gone
+    rwlock.unlock();
+    put_list_context_budget(list_context);
+    onfinish->complete(-ENOENT);
+    return;
+  }
   int pg_num = pool->get_pg_num();
   rwlock.unlock();