crush: ensure take bucket value is valid



Ensure that the take argument is a valid bucket ID before indexing the
buckets array.

Reflects ceph.git commit 93ec538e8a667699876b72459b8ad78966d89c61.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Sage Weil <sage@redhat.com>

parent f224a691

net/ceph/crush/mapper.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -835,7 +835,8 @@ int crush_do_rule(const struct crush_map *map,
		case CRUSH_RULE_TAKE:
		if ((curstep->arg1 >= 0 &&
		curstep->arg1 < map->max_devices) \|\|
		(-1-curstep->arg1 < map->max_buckets &&
		(-1-curstep->arg1 >= 0 &&
		-1-curstep->arg1 < map->max_buckets &&
		map->buckets[-1-curstep->arg1])) {
		w[0] = curstep->arg1;
		wsize = 1;