summaryrefslogtreecommitdiffstats
path: root/net/ceph
diff options
context:
space:
mode:
authorChengguang Xu <cgxu519@icloud.com>2018-02-11 09:33:28 +0800
committerIlya Dryomov <idryomov@gmail.com>2018-04-02 10:12:45 +0200
commit7377324e5bb2ed4c89e9d60691462a7272ee08a5 (patch)
treeee7cb7f1ff6106f12efbab8c7abee6fe801ded3b /net/ceph
parent11e1478df91cba4919c2bb011c49f659ebed3d16 (diff)
downloadlinux-7377324e5bb2ed4c89e9d60691462a7272ee08a5.tar.bz2
libceph: fix misjudgement of maximum monitor number
num_mon should allow up to CEPH_MAX_MON in ceph_monmap_decode(). Signed-off-by: Chengguang Xu <cgxu519@icloud.com> Reviewed-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'net/ceph')
-rw-r--r--net/ceph/mon_client.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 1547107f4854..b3dac24412d3 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -60,7 +60,7 @@ struct ceph_monmap *ceph_monmap_decode(void *p, void *end)
num_mon = ceph_decode_32(&p);
ceph_decode_need(&p, end, num_mon*sizeof(m->mon_inst[0]), bad);
- if (num_mon >= CEPH_MAX_MON)
+ if (num_mon > CEPH_MAX_MON)
goto bad;
m = kmalloc(sizeof(*m) + sizeof(m->mon_inst[0])*num_mon, GFP_NOFS);
if (m == NULL)