osd/OSDMap: Disallow negative values in _apply_upmap

A negative pg_upmap or pg_upmap_item value can cause a segfault so
ignore them.

Fixes: http://tracker.ceph.com/issues/22056
Signed-off-by: Brad Hubbard <bhubbard@redhat.com>
(cherry picked from commit 689e1cfba74e9866d411d5d21e0cf0b28343519c)

diff --git a/src/osd/OSDMap.cc b/src/osd/OSDMap.cc
index 1f67ee8cf4608089b75afe1ce68a33e3433ddd46..424455d19a8498d70f714b9cb9ebb3efdbc103d9 100644 (file)
--- a/src/osd/OSDMap.cc
+++ b/src/osd/OSDMap.cc
@@ -2127,7 +2127,8 @@ void OSDMap::_apply_upmap(const pg_pool_t& pi, pg_t raw_pg, vector<int> *raw) co
   if (p != pg_upmap.end()) {
     // make sure targets aren't marked out
     for (auto osd : p->second) {
-      if (osd != CRUSH_ITEM_NONE && osd < max_osd && osd_weight[osd] == 0) {
+      if (osd != CRUSH_ITEM_NONE && osd < max_osd && osd >= 0 &&
+          osd_weight[osd] == 0) {
        // reject/ignore the explicit mapping
        return;
       }
@@ -2154,7 +2155,7 @@ void OSDMap::_apply_upmap(const pg_pool_t& pi, pg_t raw_pg, vector<int> *raw) co
        if (osd == r.first &&
            pos < 0 &&
            !(r.second != CRUSH_ITEM_NONE && r.second < max_osd &&
-             osd_weight[r.second] == 0)) {
+             r.second >= 0 && osd_weight[r.second] == 0)) {
          pos = i;
        }
       }