diff options
| author |   Mikulas Patocka <mpatocka@redhat.com> | 2022-06-29 13:40:01 -0400 |
|---|---|---|
| committer |   Mike Snitzer <snitzer@kernel.org> | 2022-06-29 19:47:36 -0400 |
| commit | 1ebc2cec0b7dd8dad0812449110803bd875ac816 (patch) | |
| tree | a7c072147ad36cc5211e7fb4cb31ac1d30f83a5b /drivers/md/raid5.c | |
| parent | dm raid: fix accesses beyond end of raid member array (diff) | |
| download | linux-dev-1ebc2cec0b7dd8dad0812449110803bd875ac816.tar.xz linux-dev-1ebc2cec0b7dd8dad0812449110803bd875ac816.zip | |
dm raid: fix KASAN warning in raid5_remove_disk
There's a KASAN warning in raid5_remove_disk when running the LVM
testsuite. We fix this warning by verifying that the "number" variable is
within limits.
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Diffstat (limited to 'drivers/md/raid5.c')
| -rw-r--r-- | drivers/md/raid5.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index 5d09256d7f81..ba289411f26f 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -7933,7 +7933,7 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev) int err = 0; int number = rdev->raid_disk; struct md_rdev __rcu **rdevp; - struct disk_info *p = conf->disks + number; + struct disk_info *p; struct md_rdev *tmp; print_raid5_conf(conf); @@ -7952,6 +7952,9 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev) log_exit(conf); return 0; } + if (unlikely(number >= conf->pool_size)) + return 0; + p = conf->disks + number; if (rdev == rcu_access_pointer(p->rdev)) rdevp = &p->rdev; else if (rdev == rcu_access_pointer(p->replacement)) |