summaryrefslogtreecommitdiff
path: root/net/ceph/crush
diff options
context:
space:
mode:
authorIlya Dryomov <idryomov@gmail.com>2015-06-12 11:20:03 +0300
committerIlya Dryomov <idryomov@gmail.com>2015-06-25 11:49:31 +0300
commit8f529795bace5d6263b134f4ff3adccfc0a0cce6 (patch)
tree46f53222d34baeded01d146b1f223d33146c4e2a /net/ceph/crush
parent687265e5a885d6308f5d73e738efe3c2674fa218 (diff)
downloadlinux-8f529795bace5d6263b134f4ff3adccfc0a0cce6.tar.xz
crush: fix crash from invalid 'take' argument
Verify that the 'take' argument is a valid device or bucket. Otherwise ignore it (do not add the value to the working vector). Reflects ceph.git commit 9324d0a1af61e1c234cc48e2175b4e6320fff8f4. Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'net/ceph/crush')
-rw-r--r--net/ceph/crush/mapper.c11
1 files changed, 9 insertions, 2 deletions
diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c
index 5b47736d27d9..7568cb59b9e5 100644
--- a/net/ceph/crush/mapper.c
+++ b/net/ceph/crush/mapper.c
@@ -790,8 +790,15 @@ int crush_do_rule(const struct crush_map *map,
switch (curstep->op) {
case CRUSH_RULE_TAKE:
- w[0] = curstep->arg1;
- wsize = 1;
+ if ((curstep->arg1 >= 0 &&
+ curstep->arg1 < map->max_devices) ||
+ (-1-curstep->arg1 < map->max_buckets &&
+ map->buckets[-1-curstep->arg1])) {
+ w[0] = curstep->arg1;
+ wsize = 1;
+ } else {
+ dprintk(" bad take value %d\n", curstep->arg1);
+ }
break;
case CRUSH_RULE_SET_CHOOSE_TRIES: