From: NeilBrown Date: Sun, 5 Mar 2023 22:36:25 +0000 (+1100) Subject: md: avoid signed overflow in slot_store() X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=df0833da4bfac69739b849b3dff4838e590542e5;p=users%2Fjedix%2Flinux-maple.git md: avoid signed overflow in slot_store() [ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ] slot_store() uses kstrtouint() to get a slot number, but stores the result in an "int" variable (by casting a pointer). This can result in a negative slot number if the unsigned int value is very large. A negative number means that the slot is empty, but setting a negative slot number this way will not remove the device from the array. I don't think this is a serious problem, but it could cause confusion and it is best to fix it. Reported-by: Dan Carpenter Signed-off-by: NeilBrown Signed-off-by: Song Liu Signed-off-by: Sasha Levin --- diff --git a/drivers/md/md.c b/drivers/md/md.c index 0368b3c51c7f..d5c362b1602b 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -3152,6 +3152,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len) err = kstrtouint(buf, 10, (unsigned int *)&slot); if (err < 0) return err; + if (slot < 0) + /* overflow */ + return -ENOSPC; } if (rdev->mddev->pers && slot == -1) { /* Setting 'slot' on an active array requires also