crush: fix crash from invalid 'take' argument

Verify that the 'take' argument is a valid device or bucket.
Otherwise ignore it (do not add the value to the working vector).

Reflects ceph.git commit 9324d0a1af61e1c234cc48e2175b4e6320fff8f4.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

1 files changed, 9 insertions, 2 deletions

diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c
index 5b47736d27d9..7568cb59b9e5 100644
--- a/net/ceph/crush/mapper.c
+++ b/net/ceph/crush/mapper.c
@@ -790,8 +790,15 @@ int crush_do_rule(const struct crush_map *map,
 
                 switch (curstep->op) {
                 case CRUSH_RULE_TAKE:
-                        w[0] = curstep->arg1;
-                        wsize = 1;
+                        if ((curstep->arg1 >= 0 &&
+                             curstep->arg1 < map->max_devices) ||
+                            (-1-curstep->arg1 < map->max_buckets &&
+                             map->buckets[-1-curstep->arg1])) {
+                                w[0] = curstep->arg1;
+                                wsize = 1;
+                        } else {
+                                dprintk(" bad take value %d\n", curstep->arg1);
+                        }
                         break;
 
                 case CRUSH_RULE_SET_CHOOSE_TRIES: