crush: ensure take bucket value is valid

Ensure that the take argument is a valid bucket ID before indexing the
buckets array.

Reflects ceph.git commit 93ec538e8a667699876b72459b8ad78966d89c61.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Sage Weil <sage@redhat.com>
This commit is contained in:
Ilya Dryomov 2016-01-31 14:36:05 +01:00
parent f224a6915f
commit 56a4f3091d
1 changed files with 2 additions and 1 deletions

View File

@ -835,7 +835,8 @@ int crush_do_rule(const struct crush_map *map,
case CRUSH_RULE_TAKE: case CRUSH_RULE_TAKE:
if ((curstep->arg1 >= 0 && if ((curstep->arg1 >= 0 &&
curstep->arg1 < map->max_devices) || curstep->arg1 < map->max_devices) ||
(-1-curstep->arg1 < map->max_buckets && (-1-curstep->arg1 >= 0 &&
-1-curstep->arg1 < map->max_buckets &&
map->buckets[-1-curstep->arg1])) { map->buckets[-1-curstep->arg1])) {
w[0] = curstep->arg1; w[0] = curstep->arg1;
wsize = 1; wsize = 1;