diff options
| author | Chengguang Xu <cgxu519@icloud.com> | 2018-02-11 04:33:28 +0300 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2018-04-02 11:12:45 +0300 |
| commit | 7377324e5bb2ed4c89e9d60691462a7272ee08a5 (patch) | |
| tree | ee7cb7f1ff6106f12efbab8c7abee6fe801ded3b | |
| parent | 11e1478df91cba4919c2bb011c49f659ebed3d16 (diff) | |
| download | linux-7377324e5bb2ed4c89e9d60691462a7272ee08a5.tar.xz | |
libceph: fix misjudgement of maximum monitor number
num_mon should allow up to CEPH_MAX_MON in ceph_monmap_decode().
Signed-off-by: Chengguang Xu <cgxu519@icloud.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
| -rw-r--r-- | net/ceph/mon_client.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c index 1547107f4854..b3dac24412d3 100644 --- a/net/ceph/mon_client.c +++ b/net/ceph/mon_client.c @@ -60,7 +60,7 @@ struct ceph_monmap *ceph_monmap_decode(void *p, void *end) num_mon = ceph_decode_32(&p); ceph_decode_need(&p, end, num_mon*sizeof(m->mon_inst[0]), bad); - if (num_mon >= CEPH_MAX_MON) + if (num_mon > CEPH_MAX_MON) goto bad; m = kmalloc(sizeof(*m) + sizeof(m->mon_inst[0])*num_mon, GFP_NOFS); if (m == NULL) |