iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

crush: pass weight vector size to map function

Browse Source 
Pass the size of the weight vector into crush_do_rule() to ensure that we
don't access values past the end.  This can happen if the caller misbehaves
and passes a weight vector that is smaller than max_devices.

Currently the monitor tries to prevent that from happening, but this will
gracefully tolerate previous bad osdmaps that got into this state.  It's
also a bit more defensive.

Reflects ceph.git commit 5922e2c2b8335b5e46c9504349c3a55b7434c01a.

Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Reviewed-by: Sage Weil <sage@inktank.com>
This commit is contained in:
Ilya Dryomov 2013-12-24 21:19:24 +02:00
parent 2b3e0c905a
commit b3b33b0e43
3 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/linux/crush/mapper.h
View File

@ -14,6 +14,6 @@ extern int crush_find_rule(const struct crush_map *map, int ruleset, int type, i
extern int crush_do_rule(const struct crush_map *map, extern int crush_do_rule(const struct crush_map *map,
int ruleno, int ruleno,
int x, int *result, int result_max, int x, int *result, int result_max,
const __u32 *weights); const __u32 *weights, int weight_max);
#endif #endif

17
net/ceph/crush/mapper.c
View File

@ -264,8 +264,12 @@ static int crush_bucket_choose(struct crush_bucket *in, int x, int r)
* true if device is marked "out" (failed, fully offloaded) * true if device is marked "out" (failed, fully offloaded)
* of the cluster * of the cluster
*/ */
static int is_out(const struct crush_map *map, const __u32 *weight, int item, int x) static int is_out(const struct crush_map *map,
const __u32 *weight, int weight_max,
int item, int x)
{ {
if (item >= weight_max)
return 1;
if (weight[item] >= 0x10000) if (weight[item] >= 0x10000)
return 0; return 0;
if (weight[item] == 0) if (weight[item] == 0)
@ -292,7 +296,7 @@ static int is_out(const struct crush_map *map, const __u32 *weight, int item, in
*/ */
static int crush_choose(const struct crush_map *map, static int crush_choose(const struct crush_map *map,
struct crush_bucket *bucket, struct crush_bucket *bucket,
const __u32 *weight, const __u32 *weight, int weight_max,
int x, int numrep, int type, int x, int numrep, int type,
int *out, int outpos, int *out, int outpos,
int firstn, int recurse_to_leaf, int firstn, int recurse_to_leaf,
@ -396,7 +400,7 @@ static int crush_choose(const struct crush_map *map,
if (item < 0) { if (item < 0) {
if (crush_choose(map, if (crush_choose(map,
map->buckets[-1-item], map->buckets[-1-item],
weight, weight, weight_max,
x, outpos+1, 0, x, outpos+1, 0,
out2, outpos, out2, outpos,
firstn, 0, firstn, 0,
@ -414,6 +418,7 @@ static int crush_choose(const struct crush_map *map,
/* out? */ /* out? */
if (itemtype == 0) if (itemtype == 0)
reject = is_out(map, weight, reject = is_out(map, weight,
weight_max,
item, x); item, x);
else else
reject = 0; reject = 0;
@ -470,10 +475,12 @@ reject:
* @x: hash input * @x: hash input
* @result: pointer to result vector * @result: pointer to result vector
* @result_max: maximum result size * @result_max: maximum result size
* @weight: weight vector (for map leaves)
* @weight_max: size of weight vector
*/ */
int crush_do_rule(const struct crush_map *map, int crush_do_rule(const struct crush_map *map,
int ruleno, int x, int *result, int result_max, int ruleno, int x, int *result, int result_max,
const __u32 *weight) const __u32 *weight, int weight_max)
{ {
int result_len; int result_len;
int a[CRUSH_MAX_SET]; int a[CRUSH_MAX_SET];
@ -545,7 +552,7 @@ int crush_do_rule(const struct crush_map *map,
j = 0; j = 0;
osize += crush_choose(map, osize += crush_choose(map,
map->buckets[-1-w[i]], map->buckets[-1-w[i]],
weight, weight, weight_max,
x, numrep, x, numrep,
curstep->arg2, curstep->arg2,
o+osize, j, o+osize, j,

2
net/ceph/osdmap.c
View File

@ -1165,7 +1165,7 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
} }
r = crush_do_rule(osdmap->crush, ruleno, pps, osds, r = crush_do_rule(osdmap->crush, ruleno, pps, osds,
min_t(int, pool->size, *num), min_t(int, pool->size, *num),
osdmap->osd_weight); osdmap->osd_weight, osdmap->max_osd);
if (r < 0) { if (r < 0) {
pr_err("error %d from crush rule: pool %lld ruleset %d type %d" pr_err("error %d from crush rule: pool %lld ruleset %d type %d"
" size %d\n", r, pgid.pool, pool->crush_ruleset, " size %d\n", r, pgid.pool, pool->crush_ruleset,