Hi! > From: Mikulas Patocka <mpatocka@xxxxxxxxxx> > > commit d17f744e883b2f8d13cca252d71cfe8ace346f7d upstream. > > There's a KASAN warning in raid10_remove_disk when running the lvm > test lvconvert-raid-reshape.sh. We fix this warning by verifying that the > value "number" is valid. > > BUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10] > Read of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682 Is this place for array_index_nospec? Best regards, Pavel > --- a/drivers/md/raid10.c > +++ b/drivers/md/raid10.c > @@ -2139,9 +2139,12 @@ static int raid10_remove_disk(struct mdd > int err = 0; > int number = rdev->raid_disk; > struct md_rdev **rdevp; > - struct raid10_info *p = conf->mirrors + number; > + struct raid10_info *p; > > print_conf(conf); > + if (unlikely(number >= mddev->raid_disks)) > + return 0; > + p = conf->mirrors + number; > if (rdev == p->rdev) > rdevp = &p->rdev; > else if (rdev == p->replacement) > -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Attachment:
signature.asc
Description: PGP signature
