Patch "crush: fix a bug in tree bucket decode" has been added to the 3.10-stable tree

This is a note to let you know that I've just added the patch titled

crush: fix a bug in tree bucket decode

to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
crush-fix-a-bug-in-tree-bucket-decode.patch
and it can be found in the queue-3.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Ilya Dryomov <[email protected]>
Date: Mon, 29 Jun 2015 19:30:23 +0300
Subject: crush: fix a bug in tree bucket decode

From: Ilya Dryomov <[email protected]>

commit 82cd003a77173c91b9acad8033fb7931dac8d751 upstream.

struct crush_bucket_tree::num_nodes is u8, so ceph_decode_8_safe() should be used. -Wconversion catches this, but I guess it went unnoticed in all the noise it spews. The actual problem (at least for common crushmaps) isn't the u32 -> u8 truncation though - it's the advancement by 4 bytes instead of 1 in the crushmap buffer.

---
 net/ceph/osdmap.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void
 {
 	int j;
 	dout("crush_decode_tree_bucket %p to %p\n", *p, end);
-	ceph_decode_32_safe(p, end, b->num_nodes, bad);
+	ceph_decode_8_safe(p, end, b->num_nodes, bad);
 	b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
 	if (b->node_weights == NULL)
 		return -ENOMEM;

Patches currently in stable-queue which might be from [email protected] are

queue-3.10/crush-fix-a-bug-in-tree-bucket-decode.patch