s390/dasd: fix possible buffer overflow in copy_pair_show

Stefan Haberland · axboe · commit 7e8a05b47ba7 · 2022-11-23T10:37:37.000-07:00
dasd_copy_relation->entry[] array might be accessed out of bounds if the loop does not break. Fixes: a91ff09 ("s390/dasd: add copy pair setup") Signed-off-by: Stefan Haberland <sth@linux.ibm.com> Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com> Link: https://lore.kernel.org/r/20221123160719.3002694-5-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
@@ -1954,7 +1954,7 @@ dasd_copy_pair_show(struct device *dev,
 			break;
 		}
 	}
-	if (!copy->entry[i].primary)
+	if (i == DASD_CP_ENTRIES)
 		goto out;
 
 	/* print all secondary */

Original file line number	Diff line number	Diff line change
`@@ -1954,7 +1954,7 @@ dasd_copy_pair_show(struct device *dev,`
`1954`	`1954`	`break;`
`1955`	`1955`	`}`
`1956`	`1956`	`}`
`1957`		`- if (!copy->entry[i].primary)`
	`1957`	`+ if (i == DASD_CP_ENTRIES)`
`1958`	`1958`	`goto out;`
`1959`	`1959`
`1960`	`1960`	`/* print all secondary */`