From bf494e94556f9a4a27e17347f428abe8acda6e05 Mon Sep 17 00:00:00 2001
From: Sage Weil <sage@redhat.com>
Date: Mon, 7 Aug 2017 09:36:54 -0400
Subject: [PATCH] crush/CrushWrapper: fix out of bounds access

Fixes: http://tracker.ceph.com/issues/20926
Signed-off-by: Sage Weil <sage@redhat.com>
---
 src/crush/CrushWrapper.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/crush/CrushWrapper.cc b/src/crush/CrushWrapper.cc
index 9c03358aad3..05e031c86f5 100644
--- a/src/crush/CrushWrapper.cc
+++ b/src/crush/CrushWrapper.cc
@@ -1916,7 +1916,7 @@ int CrushWrapper::device_class_clone(
     // pick a new shadow bucket id that is not used by the current map
     // *or* any previous shadow buckets.
     bno = -1;
-    while (crush->buckets[-1-bno] ||
+    while (((-1-bno) < crush->max_buckets && crush->buckets[-1-bno]) ||
 	   used_ids.count(bno)) {
       --bno;
     }
-- 
2.39.5