android_kernel_google_msm/net/ceph
Ilya Dryomov 8458a84420 crush: fix a bug in tree bucket decode
commit 82cd003a77173c91b9acad8033fb7931dac8d751 upstream.

struct crush_bucket_tree::num_nodes is u8, so ceph_decode_8_safe()
should be used.  -Wconversion catches this, but I guess it went
unnoticed in all the noise it spews.  The actual problem (at least for
common crushmaps) isn't the u32 -> u8 truncation though - it's the
advancement by 4 bytes instead of 1 in the crushmap buffer.

Fixes: http://tracker.ceph.com/issues/2759

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Josh Durgin <jdurgin@redhat.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
2015-10-22 09:20:07 +08:00
..
crush
armor.c
auth.c
auth_none.c
auth_none.h
auth_x.c libceph: do not hard code max auth ticket len 2014-12-01 18:02:29 +08:00
auth_x.h
auth_x_protocol.h
buffer.c
ceph_common.c
ceph_fs.c
ceph_hash.c
ceph_strings.c
crypto.c libceph: do not crash on large auth tickets 2015-02-02 17:05:20 +08:00
crypto.h
debugfs.c
Kconfig
Makefile
messenger.c
mon_client.c libceph: gracefully handle large reply messages from the mon 2014-12-01 18:02:28 +08:00
msgpool.c
osd_client.c libceph: resend all writes after the osdmap loses the full flag 2014-03-30 21:40:30 -07:00
osdmap.c crush: fix a bug in tree bucket decode 2015-10-22 09:20:07 +08:00
pagelist.c
pagevec.c