From: Mikulas Patocka Date: Wed, 29 Jun 2022 17:40:01 +0000 (-0400) Subject: dm raid: fix KASAN warning in raid5_remove_disk X-Git-Tag: v6.1-rc5~966^2~1 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=1ebc2cec0b7dd8dad0812449110803bd875ac816;p=platform%2Fkernel%2Flinux-starfive.git dm raid: fix KASAN warning in raid5_remove_disk There's a KASAN warning in raid5_remove_disk when running the LVM testsuite. We fix this warning by verifying that the "number" variable is within limits. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer --- diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index 5d09256..ba28941 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -7933,7 +7933,7 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev) int err = 0; int number = rdev->raid_disk; struct md_rdev __rcu **rdevp; - struct disk_info *p = conf->disks + number; + struct disk_info *p; struct md_rdev *tmp; print_raid5_conf(conf); @@ -7952,6 +7952,9 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev) log_exit(conf); return 0; } + if (unlikely(number >= conf->pool_size)) + return 0; + p = conf->disks + number; if (rdev == rcu_access_pointer(p->rdev)) rdevp = &p->rdev; else if (rdev == rcu_access_pointer(p->replacement))