]> git.ipfire.org Git - thirdparty/linux.git/commit
md: avoid signed overflow in slot_store()
authorNeilBrown <neilb@suse.de>
Sun, 5 Mar 2023 22:36:25 +0000 (09:36 +1100)
committerSong Liu <song@kernel.org>
Mon, 13 Mar 2023 19:50:54 +0000 (12:50 -0700)
commit3bc57292278a0b6ac4656cad94c14f2453344b57
treed3e5ec05fe586be34665ff6296710d7ec2d27388
parent3e453522593d74a87cf68a38e14aa36ebca1dbcd
md: avoid signed overflow in slot_store()

slot_store() uses kstrtouint() to get a slot number, but stores the
result in an "int" variable (by casting a pointer).
This can result in a negative slot number if the unsigned int value is
very large.

A negative number means that the slot is empty, but setting a negative
slot number this way will not remove the device from the array.  I don't
think this is a serious problem, but it could cause confusion and it is
best to fix it.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Song Liu <song@kernel.org>
drivers/md/md.c