From: Li Nan <linan122@huawei.com>
Date: Mon, 22 May 2023 07:25:34 +0000 (+0800)
Subject: md/raid10: fix wrong setting of max_corr_read_errors
X-Git-Tag: v4.14.322~196
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=74050a3fdd4aecfd2cbf74d3c145812ab2744375;p=thirdparty%2Fkernel%2Fstable.git

md/raid10: fix wrong setting of max_corr_read_errors

[ Upstream commit f8b20a405428803bd9881881d8242c9d72c6b2b2 ]

There is no input check when echo md/max_read_errors and overflow might
occur. Add check of input number.

Fixes: 1e50915fe0bb ("raid: improve MD/raid10 handling of correctable read errors.")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230522072535.1523740-3-linan666@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/drivers/md/md.c b/drivers/md/md.c
index f2f3b42e44287..12392a4fb9c0d 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4313,6 +4313,8 @@ max_corrected_read_errors_store(struct mddev *mddev, const char *buf, size_t len
 	rv = kstrtouint(buf, 10, &n);
 	if (rv < 0)
 		return rv;
+	if (n > INT_MAX)
+		return -EINVAL;
 	atomic_set(&mddev->max_corr_read_errors, n);
 	return len;
 }