os/bluestore: reproduce out-of-bound access for bmap allocator

Reproduces: https://tracker.ceph.com/issues/39334

Signed-off-by: Igor Fedotov <ifedotov@suse.com>

diff --git a/src/os/bluestore/fastbmap_allocator_impl.h b/src/os/bluestore/fastbmap_allocator_impl.h
index 98a78d4b0ca9c7bc984edd1d546778b4098fb885..a7c7305de5ab3976c1ddd8a25bcfabc75771fa61 100755 (executable)
--- a/src/os/bluestore/fastbmap_allocator_impl.h
+++ b/src/os/bluestore/fastbmap_allocator_impl.h
@@ -352,6 +352,7 @@ protected:
       pos += d0;
     }
     bits = 1;
+    ceph_assert((pos / d0) < l0.size());
     uint64_t& val_e = l0[pos / d0];
     while (pos < l0_pos_end) {
       val_e |= bits;

diff --git a/src/test/objectstore/Allocator_test.cc b/src/test/objectstore/Allocator_test.cc
index 229d793a80b2161c2cfa6160bc50132980a87628..b74287302f67811e0805e5c42a2dd98e6699a740 100644 (file)
--- a/src/test/objectstore/Allocator_test.cc
+++ b/src/test/objectstore/Allocator_test.cc
@@ -225,6 +225,16 @@ TEST_P(AllocTest, test_alloc_non_aligned_len)
   EXPECT_EQ(want_size, alloc->allocate(want_size, alloc_unit, 0, &extents));
 }
 
+TEST_P(AllocTest, test_alloc_39334)
+{
+  int64_t block = 0x4000;
+  int64_t size = 0x5d00000000;
+
+  init_alloc(size, block);
+  alloc->init_add_free(0x4000, 0x5cffffc000);
+  EXPECT_EQ(size - block, alloc->get_free());
+}
+
 TEST_P(AllocTest, test_alloc_fragmentation)
 {
   uint64_t capacity = 4 * 1024 * 1024;