Browse Source

dm mpath: add checks for priority group count to avoid invalid memory access

This avoids the potential for invalid memory access, if/when there are
no priority groups, in response to invalid arguments being sent by the
user via DM message (e.g. "switch_group", "disable_group" or
"enable_group").

Signed-off-by: tang.junhui <tang.junhui@zte.com.cn>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
tang.junhui 8 years ago
parent
commit
cc5bd925f1
1 changed files with 2 additions and 2 deletions
  1. 2 2
      drivers/md/dm-mpath.c

+ 2 - 2
drivers/md/dm-mpath.c

@@ -1364,7 +1364,7 @@ static int switch_pg_num(struct multipath *m, const char *pgstr)
 	char dummy;
 	char dummy;
 
 
 	if (!pgstr || (sscanf(pgstr, "%u%c", &pgnum, &dummy) != 1) || !pgnum ||
 	if (!pgstr || (sscanf(pgstr, "%u%c", &pgnum, &dummy) != 1) || !pgnum ||
-	    (pgnum > m->nr_priority_groups)) {
+	    !m->nr_priority_groups || (pgnum > m->nr_priority_groups)) {
 		DMWARN("invalid PG number supplied to switch_pg_num");
 		DMWARN("invalid PG number supplied to switch_pg_num");
 		return -EINVAL;
 		return -EINVAL;
 	}
 	}
@@ -1396,7 +1396,7 @@ static int bypass_pg_num(struct multipath *m, const char *pgstr, bool bypassed)
 	char dummy;
 	char dummy;
 
 
 	if (!pgstr || (sscanf(pgstr, "%u%c", &pgnum, &dummy) != 1) || !pgnum ||
 	if (!pgstr || (sscanf(pgstr, "%u%c", &pgnum, &dummy) != 1) || !pgnum ||
-	    (pgnum > m->nr_priority_groups)) {
+	    !m->nr_priority_groups || (pgnum > m->nr_priority_groups)) {
 		DMWARN("invalid PG number supplied to bypass_pg");
 		DMWARN("invalid PG number supplied to bypass_pg");
 		return -EINVAL;
 		return -EINVAL;
 	}
 	}