[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20230322195639.1995821-22-sashal@kernel.org>
Date: Wed, 22 Mar 2023 15:56:16 -0400
From: Sasha Levin <sashal@...nel.org>
To: linux-kernel@...r.kernel.org, stable@...r.kernel.org
Cc: NeilBrown <neilb@...e.de>, Dan Carpenter <error27@...il.com>,
Song Liu <song@...nel.org>, Sasha Levin <sashal@...nel.org>,
linux-raid@...r.kernel.org
Subject: [PATCH AUTOSEL 6.2 22/45] md: avoid signed overflow in slot_store()
From: NeilBrown <neilb@...e.de>
[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
slot_store() uses kstrtouint() to get a slot number, but stores the
result in an "int" variable (by casting a pointer).
This can result in a negative slot number if the unsigned int value is
very large.
A negative number means that the slot is empty, but setting a negative
slot number this way will not remove the device from the array. I don't
think this is a serious problem, but it could cause confusion and it is
best to fix it.
Reported-by: Dan Carpenter <error27@...il.com>
Signed-off-by: NeilBrown <neilb@...e.de>
Signed-off-by: Song Liu <song@...nel.org>
Signed-off-by: Sasha Levin <sashal@...nel.org>
---
drivers/md/md.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 272cc5d14906f..beab84f0c585c 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3131,6 +3131,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
err = kstrtouint(buf, 10, (unsigned int *)&slot);
if (err < 0)
return err;
+ if (slot < 0)
+ /* overflow */
+ return -ENOSPC;
}
if (rdev->mddev->pers && slot == -1) {
/* Setting 'slot' on an active array requires also
--
2.39.2
Powered by blists - more mailing lists