osd/ReplicatedPG: discard pgnls op that is outside pg bounds

This should only happen with a buggy client, but we should avoid crashing,
and send a polite error message back.

Signed-off-by: Sage Weil <sage@redhat.com>

diff --git a/src/osd/ReplicatedPG.cc b/src/osd/ReplicatedPG.cc
index 02e36cf542a7cc6d732e74beb49eb0acdfb32a1c..e65c0842868595cf9a45cce1f9165ec71eb6b5fe 100644 (file)
--- a/src/osd/ReplicatedPG.cc
+++ b/src/osd/ReplicatedPG.cc
@@ -946,7 +946,21 @@ void ReplicatedPG::do_pg_op(OpRequestRef op)
 
        hobject_t next;
        hobject_t lower_bound = response.handle;
-        dout(10) << " pgnls lower_bound " << lower_bound << dendl;
+       hobject_t pg_start = info.pgid.pgid.get_hobj_start();
+       hobject_t pg_end = info.pgid.pgid.get_hobj_end(pool.info.get_pg_num());
+        dout(10) << " pgnls lower_bound " << lower_bound
+                << " pg_end " << pg_end << dendl;
+       if (get_sort_bitwise() &&
+           ((lower_bound != hobject_t::get_max() &&
+             cmp_bitwise(lower_bound, pg_end) >= 0) ||
+            (lower_bound != hobject_t() &&
+             cmp_bitwise(lower_bound, pg_start) < 0))) {
+         // this should only happen with a buggy client.
+         dout(10) << "outside of PG bounds " << pg_start << " .. "
+                  << pg_end << dendl;
+         result = -EINVAL;
+         break;
+       }
 
        hobject_t current = lower_bound;
        osr->flush();