From: NeilBrown Date: Sun, 5 Mar 2023 22:36:25 +0000 (+1100) Subject: md: avoid signed overflow in slot_store() X-Git-Tag: baikal/mips/sdk5.8.2~44 X-Git-Url: https://git.baikalelectronics.ru/sdk/?a=commitdiff_plain;h=8a28d43a7ce7ae73eada022e17bf7f40c5c421ae;p=kernel.git md: avoid signed overflow in slot_store() [ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ] slot_store() uses kstrtouint() to get a slot number, but stores the result in an "int" variable (by casting a pointer). This can result in a negative slot number if the unsigned int value is very large. A negative number means that the slot is empty, but setting a negative slot number this way will not remove the device from the array. I don't think this is a serious problem, but it could cause confusion and it is best to fix it. Reported-by: Dan Carpenter Signed-off-by: NeilBrown Signed-off-by: Song Liu Signed-off-by: Sasha Levin --- diff --git a/drivers/md/md.c b/drivers/md/md.c index aa2993d5d5d38..64558991ce0a0 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -3082,6 +3082,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len) err = kstrtouint(buf, 10, (unsigned int *)&slot); if (err < 0) return err; + if (slot < 0) + /* overflow */ + return -ENOSPC; } if (rdev->mddev->pers && slot == -1) { /* Setting 'slot' on an active array requires also