mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
3660b98d12
A corrupted osdmap received from a Ceph monitor or OSD may contain osd
indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts
that don't exist, i.e., that are greater than max_osd or smaller than
CEPH_HOMELESS_OSD (-1). These indices are used to create the up and
acting set in ceph_pg_to_up_acting_osds(), called from calc_target().
While most of these osd indices are checked, the one from primary_temp
is not. Subsequently, this may lead to calc_target() returning this
(potentially invalid) index as target osd for a (linger) request.
Because the osd_state, osd_weight, and osd_addr arrays only contain
max_osd entries (with indices 0 to max_osd -1), this leads to
out-of-bounds accesses when trying to read values from these arrays.
This patch fixes the issue by adding a check to get_temp_osds(), so that
only valid osd indices from primary_temp are used, and it falls back to
using the primary from pg_temp or the up set if it is invalid.
[ idryomov: changelog ]
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| crush | ||
| armor.c | ||
| auth_none.c | ||
| auth_none.h | ||
| auth_x_protocol.h | ||
| auth_x.c | ||
| auth_x.h | ||
| auth.c | ||
| buffer.c | ||
| ceph_common.c | ||
| ceph_hash.c | ||
| ceph_strings.c | ||
| cls_lock_client.c | ||
| crypto.c | ||
| crypto.h | ||
| debugfs.c | ||
| decode.c | ||
| Kconfig | ||
| Makefile | ||
| messenger_v1.c | ||
| messenger_v2.c | ||
| messenger.c | ||
| mon_client.c | ||
| msgpool.c | ||
| osd_client.c | ||
| osdmap.c | ||
| pagelist.c | ||
| pagevec.c | ||
| snapshot.c | ||
| string_table.c | ||
| striper.c | ||