libceph: fix crush_decode() call site in osdmap_decode() (9902e682) · Commits · 戴 / test

The size of the memory area feeded to crush_decode() should be limited not only by osdmap end, but also by the crush map length. Also, drop unnecessary dout() (dout() in crush_decode() conveys the same info) and step past crush map only if it is decoded successfully. Signed-off-by:

Ilya Dryomov <ilya.dryomov@inktank.com> Reviewed-by:

Alex Elder <elder@linaro.org>

net/ceph/osdmap.c

+2 −5

Original line number	Diff line number	Diff line
		@@ -802,16 +802,13 @@ static int osdmap_decode(void *p, void end, struct ceph_osdmap *map)

		/* crush */
		ceph_decode_32_safe(p, end, len, e_inval);
		dout("osdmap_decode crush len %d from off 0x%x\n", len,
		(int)(*p - start));
		ceph_decode_need(p, end, len, e_inval);
		map->crush = crush_decode(*p, end);
		*p += len;
		map->crush = crush_decode(p, min(p + len, end));
		if (IS_ERR(map->crush)) {
		err = PTR_ERR(map->crush);
		map->crush = NULL;
		goto bad;
		}
		*p += len;

		/* ignore the rest */
		*p = end;

Admin message