public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-18 22:14:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

crush: ensure bucket id is valid before indexing buckets array

Browse source 
We were indexing the buckets array without verifying the index was
within the [0,max_buckets) range.  This could happen because
a multistep rule does not have enough buckets and has CRUSH_ITEM_NONE
for an intermediate result, which would feed in CRUSH_ITEM_NONE and
make us crash.

Reflects ceph.git commit 976a24a326da8931e689ee22fce35feab5b67b76.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Sage Weil <sage@redhat.com>
This commit is contained in:
Ilya Dryomov 2016-01-31 14:35:59 +01:00
parent db6aed7023
commit f224a6915f
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
net/ceph/crush/mapper.c
View file

@ -888,6 +888,7 @@ int crush_do_rule(const struct crush_map *map,
osize = 0; osize = 0;
for (i = 0; i < wsize; i++) { for (i = 0; i < wsize; i++) {
int bno;
/* /*
* see CRUSH_N, CRUSH_N_MINUS macros. * see CRUSH_N, CRUSH_N_MINUS macros.
* basically, numrep <= 0 means relative to * basically, numrep <= 0 means relative to
@ -900,6 +901,13 @@ int crush_do_rule(const struct crush_map *map,
continue; continue;
} }
j = 0; j = 0;
/* make sure bucket id is valid */
bno = -1 - w[i];
if (bno < 0 || bno >= map->max_buckets) {
/* w[i] is probably CRUSH_ITEM_NONE */
dprintk(" bad w[i] %d\n", w[i]);
continue;
}
if (firstn) { if (firstn) {
int recurse_tries; int recurse_tries;
if (choose_leaf_tries) if (choose_leaf_tries)
@ -911,7 +919,7 @@ int crush_do_rule(const struct crush_map *map,
recurse_tries = choose_tries; recurse_tries = choose_tries;
osize += crush_choose_firstn( osize += crush_choose_firstn(
map, map,
map->buckets[-1-w[i]], map->buckets[bno],
weight, weight_max, weight, weight_max,
x, numrep, x, numrep,
curstep->arg2, curstep->arg2,
@ -930,7 +938,7 @@ int crush_do_rule(const struct crush_map *map,
numrep : (result_max-osize)); numrep : (result_max-osize));
crush_choose_indep( crush_choose_indep(
map, map,
map->buckets[-1-w[i]], map->buckets[bno],
weight, weight_max, weight, weight_max,
x, out_size, numrep, x, out_size, numrep,
curstep->arg2, curstep->arg2,