ceph: gracefully avoid empty crush buckets

This avoids a divide by zero when the input and/or map are
malformed.

Signed-off-by: Sage Weil <sage@newdream.net>

1 files changed, 7 insertions, 2 deletions

diff --git a/fs/ceph/crush/mapper.c b/fs/ceph/crush/mapper.c
index 0f0730c62695..c268393adfcb 100644
--- a/fs/ceph/crush/mapper.c
+++ b/fs/ceph/crush/mapper.c
@@ -299,7 +299,7 @@ static int crush_choose(struct crush_map *map,
 	struct crush_bucket *in = bucket;
 	int r;
 	int i;
-	int item;
+	int item = 0;
 	int itemtype;
 	int collide, reject;
 	const int orig_tries = 5; /* attempts before we fall back to search */
@@ -316,6 +316,7 @@ static int crush_choose(struct crush_map *map,
 			/* choose through intervening buckets */
 			flocal = 0;
 			do {
+				collide = 0;
 				retry_bucket = 0;
 				r = rep;
 				if (in->alg == CRUSH_BUCKET_UNIFORM) {
@@ -340,6 +341,10 @@ static int crush_choose(struct crush_map *map,
 				}
 
 				/* bucket choose */
+				if (in->size == 0) {
+					reject = 1;
+					goto reject;
+				}
 				if (flocal >= (in->size>>1) &&
 				    flocal > orig_tries)
 					item = bucket_perm_choose(in, x, r);
@@ -363,7 +368,6 @@ static int crush_choose(struct crush_map *map,
 				}
 
 				/* collision? */
-				collide = 0;
 				for (i = 0; i < outpos; i++) {
 					if (out[i] == item) {
 						collide = 1;
@@ -388,6 +392,7 @@ static int crush_choose(struct crush_map *map,
 						reject = 0;
 				}
 
+reject:
 				if (reject || collide) {
 					ftotal++;
 					flocal++;