diff options
| author | Ilya Dryomov <idryomov@gmail.com> | 2016-01-31 14:36:05 +0100 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2016-02-04 18:25:50 +0100 |
| commit | 56a4f3091dceb7dfc14dc3ef1d5f59fe39ba4447 (patch) | |
| tree | 0ccfe9a3f823e53bd1880f83fcf1be815b8e7c8e /net/ceph | |
| parent | f224a6915f266921507bb6e50a82f87a3de5b4b5 (diff) | |
crush: ensure take bucket value is valid
Ensure that the take argument is a valid bucket ID before indexing the
buckets array.
Reflects ceph.git commit 93ec538e8a667699876b72459b8ad78966d89c61.
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Diffstat (limited to 'net/ceph')
| -rw-r--r-- | net/ceph/crush/mapper.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c index 97ecf6f262aa..abb700621e4a 100644 --- a/net/ceph/crush/mapper.c +++ b/net/ceph/crush/mapper.c @@ -835,7 +835,8 @@ int crush_do_rule(const struct crush_map *map, case CRUSH_RULE_TAKE: if ((curstep->arg1 >= 0 && curstep->arg1 < map->max_devices) || - (-1-curstep->arg1 < map->max_buckets && + (-1-curstep->arg1 >= 0 && + -1-curstep->arg1 < map->max_buckets && map->buckets[-1-curstep->arg1])) { w[0] = curstep->arg1; wsize = 1; |