forked from luck/tmp_suning_uos_patched
libceph: fix crush_decode() call site in osdmap_decode()
The size of the memory area feeded to crush_decode() should be limited not only by osdmap end, but also by the crush map length. Also, drop unnecessary dout() (dout() in crush_decode() conveys the same info) and step past crush map only if it is decoded successfully. Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com> Reviewed-by: Alex Elder <elder@linaro.org>
This commit is contained in:
parent
2d88b2e081
commit
9902e682c7
|
@ -802,16 +802,13 @@ static int osdmap_decode(void **p, void *end, struct ceph_osdmap *map)
|
|||
|
||||
/* crush */
|
||||
ceph_decode_32_safe(p, end, len, e_inval);
|
||||
dout("osdmap_decode crush len %d from off 0x%x\n", len,
|
||||
(int)(*p - start));
|
||||
ceph_decode_need(p, end, len, e_inval);
|
||||
map->crush = crush_decode(*p, end);
|
||||
*p += len;
|
||||
map->crush = crush_decode(*p, min(*p + len, end));
|
||||
if (IS_ERR(map->crush)) {
|
||||
err = PTR_ERR(map->crush);
|
||||
map->crush = NULL;
|
||||
goto bad;
|
||||
}
|
||||
*p += len;
|
||||
|
||||
/* ignore the rest */
|
||||
*p = end;
|
||||
|
|
Loading…
Reference in New Issue
Block a user