| From 0e0497c0c017664994819f4602dc07fd95896c52 Mon Sep 17 00:00:00 2001 |
| From: Mikulas Patocka <mpatocka@redhat.com> |
| Date: Mon, 22 Jun 2009 10:08:02 +0100 |
| Subject: dm mpath: validate table argument count |
| |
| From: Mikulas Patocka <mpatocka@redhat.com> |
| |
| commit 0e0497c0c017664994819f4602dc07fd95896c52 upstream. |
| |
| The parser reads the argument count as a number but doesn't check that |
| sufficient arguments are supplied. This command triggers the bug: |
| |
| dmsetup create mpath --table "0 `blockdev --getsize /dev/mapper/cr0` |
| multipath 0 0 2 1 round-robin 1000 0 1 1 /dev/mapper/cr0 |
| round-robin 0 1 1 /dev/mapper/cr1 1000" |
| kernel BUG at drivers/md/dm-mpath.c:530! |
| |
| Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> |
| Signed-off-by: Alasdair G Kergon <agk@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/md/dm-mpath.c | 6 ++++++ |
| 1 file changed, 6 insertions(+) |
| |
| --- a/drivers/md/dm-mpath.c |
| +++ b/drivers/md/dm-mpath.c |
| @@ -554,6 +554,12 @@ static int parse_path_selector(struct ar |
| return -EINVAL; |
| } |
| |
| + if (ps_argc > as->argc) { |
| + dm_put_path_selector(pst); |
| + ti->error = "not enough arguments for path selector"; |
| + return -EINVAL; |
| + } |
| + |
| r = pst->create(&pg->ps, ps_argc, as->argv); |
| if (r) { |
| dm_put_path_selector(pst); |
