* [PATCH] dm mpath: add check for count of groups to avoid wild pointer access
@ 2016-11-04 4:37 tang.junhui
0 siblings, 0 replies; 2+ messages in thread
From: tang.junhui @ 2016-11-04 4:37 UTC (permalink / raw)
To: agk, snitzer; +Cc: zhang.kai16, dm-devel, tang.junhui
From: "tang.junhui" <tang.junhui@zte.com.cn>
pg is not assigned to a group address when count of multipath groups
is zero in bypass_pg_num(), then it is used in bypass_pg(), which may
cause wild pointer access.
Signed-off-by: tang.junhui <tang.junhui@zte.com.cn>
---
drivers/md/dm-mpath.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index e477af8..ab4d716 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1394,7 +1394,7 @@ static int bypass_pg_num(struct multipath *m, const char *pgstr, bool bypassed)
char dummy;
if (!pgstr || (sscanf(pgstr, "%u%c", &pgnum, &dummy) != 1) || !pgnum ||
- (pgnum > m->nr_priority_groups)) {
+ !m->nr_priority_groups || (pgnum > m->nr_priority_groups)) {
DMWARN("invalid PG number supplied to bypass_pg");
return -EINVAL;
}
--
2.8.1.windows.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [PATCH] dm mpath: add check for count of groups to avoid wild pointer access
@ 2016-11-03 10:49 tang.junhui
0 siblings, 0 replies; 2+ messages in thread
From: tang.junhui @ 2016-11-03 10:49 UTC (permalink / raw)
To: agk, snitzer; +Cc: zhang.kai16, dm-devel, tang.junhui
From: "tang.junhui" <tang.junhui@zte.com.cn>
pg is not assigned to a group address when count of multipath groups
is zero in bypass_pg_num(), then it is used in bypass_pg(), which may
cause wild pointer access.
Signed-off-by: tang.junhui <tang.junhui@zte.com.cn>
---
drivers/md/dm-mpath.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index d376dc8..8c1359c 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1084,7 +1084,7 @@ static int switch_pg_num(struct multipath *m, const char *pgstr)
char dummy;
if (!pgstr || (sscanf(pgstr, "%u%c", &pgnum, &dummy) != 1) || !pgnum ||
- (pgnum > m->nr_priority_groups)) {
+ !m->nr_priority_groups || (pgnum > m->nr_priority_groups)) {
DMWARN("invalid PG number supplied to switch_pg_num");
return -EINVAL;
}
--
2.8.1.windows.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-11-04 4:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-11-04 4:37 [PATCH] dm mpath: add check for count of groups to avoid wild pointer access tang.junhui
-- strict thread matches above, loose matches on Subject: below --
2016-11-03 10:49 tang.junhui
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.