From patchwork Wed Feb 3 14:23:17 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilya Dryomov X-Patchwork-Id: 8203711 Return-Path: X-Original-To: patchwork-ceph-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 28C089F38B for ; Wed, 3 Feb 2016 14:23:37 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 46D86202BE for ; Wed, 3 Feb 2016 14:23:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5C30C20270 for ; Wed, 3 Feb 2016 14:23:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753422AbcBCOXe (ORCPT ); Wed, 3 Feb 2016 09:23:34 -0500 Received: from mail-wm0-f54.google.com ([74.125.82.54]:37255 "EHLO mail-wm0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751952AbcBCOXa (ORCPT ); Wed, 3 Feb 2016 09:23:30 -0500 Received: by mail-wm0-f54.google.com with SMTP id l66so72740398wml.0 for ; Wed, 03 Feb 2016 06:23:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=SwlitpZ6KImd7P24VMgW0j5frD6ONqOqH+qRrtKRA7o=; b=jhkkfOZsssoFdvnu3Sdgd++fon3NSDUJvwkfGxOnZhMXXnKzAo2fehEvrVN5Txe4oF R36JXzGNrb+OsAAPioaHmy1n9VPvHIcTkgYMvIuu6J2t6/P30Joc3sXWkeKiAji2tqxf ONPhlK1nwrVYEHK3a025nHfZdyC6TnVDfX3cDjfs7QWSBsYtlb+PMO0id/PFiCuoaZ4T WuYMk/EDKlGJy3E7aeANCtnui+ri+4lTByPyzYT5L9qLtW54U3fEpl/ZCZnTKorp2kF8 3X91QuQqpOKcOiS7aUAOsMrQSRp7INUBuQ1QVkc97WlWfZFXF1uPfYnhQdV1oXTBHQxE 7cDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=SwlitpZ6KImd7P24VMgW0j5frD6ONqOqH+qRrtKRA7o=; b=SPz7VQSehJx4bCKZl7zfD0zeW41TfKGJPFRpiD1oZRxIZeyEJOxQVA84h4MIEJyniF lMP/ekOSvzBWi8odIivMAdhfpZVOCDyCmlujWB7GkPR+LkR8/SS2NL7YRRhxuTB/wLSW frDy1+ncIeD4ILgHxXSD340MOVGVZqNYwoIBu1FbRX/NkoojdsKFtGouXO5XN20TfURP eTEKASh7jCAhHRg6/EKLzdgkxYJc0z1NFGpKGR0yf4nONWhtd0KULQWuHOUz7SJUChV3 eRVwTjjGfGKoymvaMCBNhdyOJ520njFPu8iQpqwRPrGZwOJuizKTlNr9dSQ2A82UXQI3 L+Yw== X-Gm-Message-State: AG10YORiy1O/ETgfqtsdZAU0leyVa6U+KbOyGy4I2e8F99fCEOtzlsCdShTxzZ0rPDXlTQ== X-Received: by 10.28.175.147 with SMTP id y141mr4084409wme.64.1454509409128; Wed, 03 Feb 2016 06:23:29 -0800 (PST) Received: from dhcp-27-199.brq.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id q75sm21838841wmd.6.2016.02.03.06.23.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 03 Feb 2016 06:23:28 -0800 (PST) From: Ilya Dryomov To: ceph-devel@vger.kernel.org Cc: Sage Weil Subject: [PATCH 1/5] crush: ensure bucket id is valid before indexing buckets array Date: Wed, 3 Feb 2016 15:23:17 +0100 Message-Id: <1454509401-19734-2-git-send-email-idryomov@gmail.com> X-Mailer: git-send-email 2.4.3 In-Reply-To: <1454509401-19734-1-git-send-email-idryomov@gmail.com> References: <1454509401-19734-1-git-send-email-idryomov@gmail.com> Sender: ceph-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: ceph-devel@vger.kernel.org X-Spam-Status: No, score=-7.2 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP We were indexing the buckets array without verifying the index was within the [0,max_buckets) range. This could happen because a multistep rule does not have enough buckets and has CRUSH_ITEM_NONE for an intermediate result, which would feed in CRUSH_ITEM_NONE and make us crash. Reflects ceph.git commit 976a24a326da8931e689ee22fce35feab5b67b76. Signed-off-by: Ilya Dryomov --- net/ceph/crush/mapper.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c index 393bfb22d5bb..97ecf6f262aa 100644 --- a/net/ceph/crush/mapper.c +++ b/net/ceph/crush/mapper.c @@ -888,6 +888,7 @@ int crush_do_rule(const struct crush_map *map, osize = 0; for (i = 0; i < wsize; i++) { + int bno; /* * see CRUSH_N, CRUSH_N_MINUS macros. * basically, numrep <= 0 means relative to @@ -900,6 +901,13 @@ int crush_do_rule(const struct crush_map *map, continue; } j = 0; + /* make sure bucket id is valid */ + bno = -1 - w[i]; + if (bno < 0 || bno >= map->max_buckets) { + /* w[i] is probably CRUSH_ITEM_NONE */ + dprintk(" bad w[i] %d\n", w[i]); + continue; + } if (firstn) { int recurse_tries; if (choose_leaf_tries) @@ -911,7 +919,7 @@ int crush_do_rule(const struct crush_map *map, recurse_tries = choose_tries; osize += crush_choose_firstn( map, - map->buckets[-1-w[i]], + map->buckets[bno], weight, weight_max, x, numrep, curstep->arg2, @@ -930,7 +938,7 @@ int crush_do_rule(const struct crush_map *map, numrep : (result_max-osize)); crush_choose_indep( map, - map->buckets[-1-w[i]], + map->buckets[bno], weight, weight_max, x, out_size, numrep, curstep->arg2,