diff mbox series

dm-raid: fix KASAN warning in raid5_remove_disk

Message ID alpine.LRH.2.02.2206291332230.18482@file01.intranet.prod.int.rdu2.redhat.com (mailing list archive)
State New, archived
Delegated to: Song Liu
Headers show
Series dm-raid: fix KASAN warning in raid5_remove_disk | expand

Commit Message

Mikulas Patocka June 29, 2022, 5:40 p.m. UTC 
There's a KASAN warning in raid5_remove_disk when running the LVM
testsuite. We fix this warning by verifying that the "number" variable is
within limits.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org

---
 drivers/md/raid5.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff mbox series

Patch

Index: linux-2.6/drivers/md/raid5.c
===================================================================
--- linux-2.6.orig/drivers/md/raid5.c	2022-06-15 09:06:14.000000000 +0200
+++ linux-2.6/drivers/md/raid5.c	2022-06-16 13:33:18.000000000 +0200
@@ -7933,7 +7933,7 @@  static int raid5_remove_disk(struct mdde
 	int err = 0;
 	int number = rdev->raid_disk;
 	struct md_rdev __rcu **rdevp;
-	struct disk_info *p = conf->disks + number;
+	struct disk_info *p;
 	struct md_rdev *tmp;
 
 	print_raid5_conf(conf);
@@ -7952,6 +7952,9 @@  static int raid5_remove_disk(struct mdde
 		log_exit(conf);
 		return 0;
 	}
+	if (unlikely(number >= conf->pool_size))
+		return 0;
+	p = conf->disks + number;
 	if (rdev == rcu_access_pointer(p->rdev))
 		rdevp = &p->rdev;
 	else if (rdev == rcu_access_pointer(p->replacement))