From: Sage Weil <sage@redhat.com>
Date: Tue, 13 Oct 2015 13:55:01 +0000 (-0400)
Subject: crush/mapper: ensure take bucket value is valid
X-Git-Tag: v0.94.6~62^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=refs%2Fpull%2F6430%2Fhead;p=ceph.git

crush/mapper: ensure take bucket value is valid

Ensure that the take argument is a valid bucket ID before indexing the
buckets array.

Signed-off-by: Sage Weil <sage@redhat.com>
(cherry picked from commit 93ec538e8a667699876b72459b8ad78966d89c61)
---

diff --git a/src/crush/mapper.c b/src/crush/mapper.c
index 3faf6f580403..22ee5b93dcab 100644
--- a/src/crush/mapper.c
+++ b/src/crush/mapper.c
@@ -841,7 +841,8 @@ int crush_do_rule(const struct crush_map *map,
 		case CRUSH_RULE_TAKE:
 			if ((curstep->arg1 >= 0 &&
 			     curstep->arg1 < map->max_devices) ||
-			    (-1-curstep->arg1 < map->max_buckets &&
+			    (-1-curstep->arg1 >= 0 &&
+			     -1-curstep->arg1 < map->max_buckets &&
 			     map->buckets[-1-curstep->arg1])) {
 				w[0] = curstep->arg1;
 				wsize = 1;