Patch "md: avoid signed overflow in slot_store()" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    md: avoid signed overflow in slot_store()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     md-avoid-signed-overflow-in-slot_store.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2be6239463ed3769e2d565954be559862b92d62e
Author: NeilBrown <neilb@xxxxxxx>
Date:   Mon Mar 6 09:36:25 2023 +1100

    md: avoid signed overflow in slot_store()
    
    [ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
    
    slot_store() uses kstrtouint() to get a slot number, but stores the
    result in an "int" variable (by casting a pointer).
    This can result in a negative slot number if the unsigned int value is
    very large.
    
    A negative number means that the slot is empty, but setting a negative
    slot number this way will not remove the device from the array.  I don't
    think this is a serious problem, but it could cause confusion and it is
    best to fix it.
    
    Reported-by: Dan Carpenter <error27@xxxxxxxxx>
    Signed-off-by: NeilBrown <neilb@xxxxxxx>
    Signed-off-by: Song Liu <song@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 9e54b865f30da..bd0c9dfac9815 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3189,6 +3189,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
 		err = kstrtouint(buf, 10, (unsigned int *)&slot);
 		if (err < 0)
 			return err;
+		if (slot < 0)
+			/* overflow */
+			return -ENOSPC;
 	}
 	if (rdev->mddev->pers && slot == -1) {
 		/* Setting 'slot' on an active array requires also



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux