7/19

Joe Thornber
2002-12-16T10:04:06Z

There's a bug in the dm-stripe.c constructor failing top check if enough
destinations are handed in. [Heinz Mauelshagen]
--- diff/drivers/md/dm-stripe.c 2002-12-16 09:40:48.000000000 +0000
+++ source/drivers/md/dm-stripe.c 2002-12-16 09:40:53.000000000 +0000
@@ -131,6 +131,15 @@
return -EINVAL;
}

+ /*
+ * Do we have enough arguments for that many stripes ?
+ */
+ if (argc != (2 + 2 * stripes)) {
+ ti->error = "dm-stripe: Not enough destinations "
+ "specified";
+ return -EINVAL;
+ }
+
sc = alloc_context(stripes);
if (!sc) {
ti->error = "dm-stripe: Memory allocation for striped context "
@@ -151,13 +160,6 @@
* Get the stripe destinations.
*/
for (i = 0; i < stripes; i++) {
- if (argc < 2) {
- ti->error = "dm-stripe: Not enough destinations "
- "specified";
- kfree(sc);
- return -EINVAL;
- }
-
argv += 2;

r = get_stripe(ti, sc, i, argv);