summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorIlya Dryomov <idryomov@gmail.com>2016-01-31 16:36:05 +0300
committerIlya Dryomov <idryomov@gmail.com>2016-02-04 20:25:50 +0300
commit56a4f3091dceb7dfc14dc3ef1d5f59fe39ba4447 (patch)
tree0ccfe9a3f823e53bd1880f83fcf1be815b8e7c8e /net
parentf224a6915f266921507bb6e50a82f87a3de5b4b5 (diff)
downloadlinux-56a4f3091dceb7dfc14dc3ef1d5f59fe39ba4447.tar.xz
crush: ensure take bucket value is valid
Ensure that the take argument is a valid bucket ID before indexing the buckets array. Reflects ceph.git commit 93ec538e8a667699876b72459b8ad78966d89c61. Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Sage Weil <sage@redhat.com>
Diffstat (limited to 'net')
-rw-r--r--net/ceph/crush/mapper.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c
index 97ecf6f262aa..abb700621e4a 100644
--- a/net/ceph/crush/mapper.c
+++ b/net/ceph/crush/mapper.c
@@ -835,7 +835,8 @@ int crush_do_rule(const struct crush_map *map,
case CRUSH_RULE_TAKE:
if ((curstep->arg1 >= 0 &&
curstep->arg1 < map->max_devices) ||
- (-1-curstep->arg1 < map->max_buckets &&
+ (-1-curstep->arg1 >= 0 &&
+ -1-curstep->arg1 < map->max_buckets &&
map->buckets[-1-curstep->arg1])) {
w[0] = curstep->arg1;
wsize = 1;