From: Brad Hubbard <bhubbard@redhat.com>
Date: Fri, 3 Aug 2018 06:12:49 +0000 (+1000)
Subject: osd/OSDMap: Disallow negative values in _apply_upmap
X-Git-Tag: v13.2.2~34^2~1
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=81e34b769df0faf7dacc6fadab573c731d043579;p=ceph.git

osd/OSDMap: Disallow negative values in _apply_upmap

A negative pg_upmap or pg_upmap_item value can cause a segfault so
ignore them.

Fixes: http://tracker.ceph.com/issues/22056

Signed-off-by: Brad Hubbard <bhubbard@redhat.com>
(cherry picked from commit 689e1cfba74e9866d411d5d21e0cf0b28343519c)
---

diff --git a/src/osd/OSDMap.cc b/src/osd/OSDMap.cc
index 1f67ee8cf460..424455d19a84 100644
--- a/src/osd/OSDMap.cc
+++ b/src/osd/OSDMap.cc
@@ -2127,7 +2127,8 @@ void OSDMap::_apply_upmap(const pg_pool_t& pi, pg_t raw_pg, vector<int> *raw) co
   if (p != pg_upmap.end()) {
     // make sure targets aren't marked out
     for (auto osd : p->second) {
-      if (osd != CRUSH_ITEM_NONE && osd < max_osd && osd_weight[osd] == 0) {
+      if (osd != CRUSH_ITEM_NONE && osd < max_osd && osd >= 0 &&
+          osd_weight[osd] == 0) {
 	// reject/ignore the explicit mapping
 	return;
       }
@@ -2154,7 +2155,7 @@ void OSDMap::_apply_upmap(const pg_pool_t& pi, pg_t raw_pg, vector<int> *raw) co
 	if (osd == r.first &&
 	    pos < 0 &&
 	    !(r.second != CRUSH_ITEM_NONE && r.second < max_osd &&
-	      osd_weight[r.second] == 0)) {
+	      r.second >= 0 && osd_weight[r.second] == 0)) {
 	  pos = i;
 	}
       }