Commit 1ebc2cec authored by Mikulas Patocka's avatar Mikulas Patocka Committed by Mike Snitzer

dm raid: fix KASAN warning in raid5_remove_disk

There's a KASAN warning in raid5_remove_disk when running the LVM
testsuite. We fix this warning by verifying that the "number" variable is
within limits.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: default avatarMike Snitzer <snitzer@kernel.org>
parent 332bd077
...@@ -7933,7 +7933,7 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev) ...@@ -7933,7 +7933,7 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
int err = 0; int err = 0;
int number = rdev->raid_disk; int number = rdev->raid_disk;
struct md_rdev __rcu **rdevp; struct md_rdev __rcu **rdevp;
struct disk_info *p = conf->disks + number; struct disk_info *p;
struct md_rdev *tmp; struct md_rdev *tmp;
print_raid5_conf(conf); print_raid5_conf(conf);
...@@ -7952,6 +7952,9 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev) ...@@ -7952,6 +7952,9 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
log_exit(conf); log_exit(conf);
return 0; return 0;
} }
if (unlikely(number >= conf->pool_size))
return 0;
p = conf->disks + number;
if (rdev == rcu_access_pointer(p->rdev)) if (rdev == rcu_access_pointer(p->rdev))
rdevp = &p->rdev; rdevp = &p->rdev;
else if (rdev == rcu_access_pointer(p->replacement)) else if (rdev == rcu_access_pointer(p->replacement))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment