crush: fix crash from invalid 'take' argument



Verify that the 'take' argument is a valid device or bucket.
Otherwise ignore it (do not add the value to the working vector).

Reflects ceph.git commit 9324d0a1af61e1c234cc48e2175b4e6320fff8f4.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

parent 687265e5

net/ceph/crush/mapper.c

+9 −2

Original line number	Diff line number	Diff line
		@@ -790,8 +790,15 @@ int crush_do_rule(const struct crush_map *map,

		switch (curstep->op) {
		case CRUSH_RULE_TAKE:
		if ((curstep->arg1 >= 0 &&
		curstep->arg1 < map->max_devices) \|\|
		(-1-curstep->arg1 < map->max_buckets &&
		map->buckets[-1-curstep->arg1])) {
		w[0] = curstep->arg1;
		wsize = 1;
		} else {
		dprintk(" bad take value %d\n", curstep->arg1);
		}
		break;

		case CRUSH_RULE_SET_CHOOSE_TRIES: