diff mbox series

[SRU,Xenial,2/6] crush: ensure take bucket value is valid

Message ID 20171101203753.21016-3-billy.olsen@canonical.com
State New
Headers show
Series Backport Ceph CRUSH_TUNABLES5 support | expand

Commit Message

Billy Olsen Nov. 1, 2017, 8:37 p.m. UTC 
From: Ilya Dryomov <idryomov@gmail.com>

BugLink: https://bugs.launchpad.net/bugs/1728739

Ensure that the take argument is a valid bucket ID before indexing the
buckets array.

Reflects ceph.git commit 93ec538e8a667699876b72459b8ad78966d89c61.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Sage Weil <sage@redhat.com>
(cherry picked from commit 56a4f3091dceb7dfc14dc3ef1d5f59fe39ba4447)
Signed-off-by: Billy Olsen <billy.olsen@canonical.com>
---
 net/ceph/crush/mapper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c
index 97ecf6f262aa..abb700621e4a 100644
--- a/net/ceph/crush/mapper.c
+++ b/net/ceph/crush/mapper.c
@@ -835,7 +835,8 @@  int crush_do_rule(const struct crush_map *map,
 		case CRUSH_RULE_TAKE:
 			if ((curstep->arg1 >= 0 &&
 			     curstep->arg1 < map->max_devices) ||
-			    (-1-curstep->arg1 < map->max_buckets &&
+			    (-1-curstep->arg1 >= 0 &&
+			     -1-curstep->arg1 < map->max_buckets &&
 			     map->buckets[-1-curstep->arg1])) {
 				w[0] = curstep->arg1;
 				wsize = 1;