Merge tag 'io_uring-5.15-2021-09-11' of git://git.kernel.dk/linux-block

[linux-2.6-microblaze.git] / fs / ceph / mdsmap.c

diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c
index 3c444b9..61d67cb 100644 (file)
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -122,6 +122,7 @@ struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end, bool msgr2)
        int err;
        u8 mdsmap_v;
        u16 mdsmap_ev;
+       u32 target;
 
        m = kzalloc(sizeof(*m), GFP_NOFS);
        if (!m)
@@ -260,9 +261,14 @@ struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end, bool msgr2)
                                                       sizeof(u32), GFP_NOFS);
                        if (!info->export_targets)
                                goto nomem;
-                       for (j = 0; j < num_export_targets; j++)
-                               info->export_targets[j] =
-                                      ceph_decode_32(&pexport_targets);
+                       for (j = 0; j < num_export_targets; j++) {
+                               target = ceph_decode_32(&pexport_targets);
+                               if (target >= m->possible_max_rank) {
+                                       err = -EIO;
+                                       goto corrupt;
+                               }
+                               info->export_targets[j] = target;
+                       }
                } else {
                        info->export_targets = NULL;
                }