diff options
| author | Ilya Dryomov <idryomov@gmail.com> | 2015-06-12 10:20:03 +0200 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2015-06-25 10:49:31 +0200 |
| commit | 8f529795bace5d6263b134f4ff3adccfc0a0cce6 (patch) | |
| tree | 46f53222d34baeded01d146b1f223d33146c4e2a /net | |
| parent | ceph: switch some GFP_NOFS memory allocation to GFP_KERNEL (diff) | |
| download | linux-8f529795bace5d6263b134f4ff3adccfc0a0cce6.tar.xz linux-8f529795bace5d6263b134f4ff3adccfc0a0cce6.zip | |
crush: fix crash from invalid 'take' argument
Verify that the 'take' argument is a valid device or bucket.
Otherwise ignore it (do not add the value to the working vector).
Reflects ceph.git commit 9324d0a1af61e1c234cc48e2175b4e6320fff8f4.
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ceph/crush/mapper.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c index 5b47736d27d9..7568cb59b9e5 100644 --- a/net/ceph/crush/mapper.c +++ b/net/ceph/crush/mapper.c @@ -790,8 +790,15 @@ int crush_do_rule(const struct crush_map *map, switch (curstep->op) { case CRUSH_RULE_TAKE: - w[0] = curstep->arg1; - wsize = 1; + if ((curstep->arg1 >= 0 && + curstep->arg1 < map->max_devices) || + (-1-curstep->arg1 < map->max_buckets && + map->buckets[-1-curstep->arg1])) { + w[0] = curstep->arg1; + wsize = 1; + } else { + dprintk(" bad take value %d\n", curstep->arg1); + } break; case CRUSH_RULE_SET_CHOOSE_TRIES: |