crush/mapper: ensure take bucket value is valid

Ensure that the take argument is a valid bucket ID before indexing the
buckets array.

Signed-off-by: Sage Weil <sage@redhat.com>
(cherry picked from commit 93ec538e8a667699876b72459b8ad78966d89c61)
(cherry picked from commit a52f7cb372339dffbeed7dae8ce2680586760754)

diff --git a/src/crush/mapper.c b/src/crush/mapper.c
index 3faf6f5804037a9cffcce8d721a5014a237892e7..22ee5b93dcab98c1816ac205d9a24286bea9759d 100644 (file)
--- a/src/crush/mapper.c
+++ b/src/crush/mapper.c
@@ -841,7 +841,8 @@ int crush_do_rule(const struct crush_map *map,
                case CRUSH_RULE_TAKE:
                        if ((curstep->arg1 >= 0 &&
                             curstep->arg1 < map->max_devices) ||
-                           (-1-curstep->arg1 < map->max_buckets &&
+                           (-1-curstep->arg1 >= 0 &&
+                            -1-curstep->arg1 < map->max_buckets &&
                             map->buckets[-1-curstep->arg1])) {
                                w[0] = curstep->arg1;
                                wsize = 1;