diff options
author | Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com> | 2024-02-29 12:52:07 +0100 |
---|---|---|
committer | Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com> | 2024-03-11 11:06:34 +0100 |
commit | e97ca3583c96591af0e4863c12c394074a51c84d (patch) | |
tree | 3344c75a4a142775d258dc10498f665100887f89 /Manage.c | |
parent | mdadm: drop get_required_spare_criteria() (diff) | |
download | mdadm-e97ca3583c96591af0e4863c12c394074a51c84d.tar.xz mdadm-e97ca3583c96591af0e4863c12c394074a51c84d.zip |
Manage: fix check after dereference issue
The code dereferences dev_st earlier without checking, it gives SAST
problem.
dev_st is needed for attempt_re_add(), but it is executed only if
dv->disposition != 'S', so move disposition check up.
tst is a must to reach this place, dup_super() have to return valid
pointer, all it needs to check is if load_super() returns superblock.
Signed-off-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com>
Diffstat (limited to '')
-rw-r--r-- | Manage.c | 26 |
1 files changed, 12 insertions, 14 deletions
@@ -794,25 +794,23 @@ int Manage_add(int fd, int tfd, struct mddev_dev *dv, * simply re-add it. */ - if (array->not_persistent == 0) { + if (array->not_persistent == 0 && dv->disposition != 'S') { + int rv = 0; + dev_st = dup_super(tst); dev_st->ss->load_super(dev_st, tfd, NULL); - if (dev_st->sb && dv->disposition != 'S') { - int rv; - rv = attempt_re_add(fd, tfd, dv, dev_st, tst, - rdev, update, devname, - verbose, array); - dev_st->ss->free_super(dev_st); - if (rv) { - free(dev_st); - return rv; - } - } - if (dev_st) { + if (dev_st->sb) { + rv = attempt_re_add(fd, tfd, dv, dev_st, tst, rdev, update, + devname, verbose, array); + dev_st->ss->free_super(dev_st); - free(dev_st); } + + free(dev_st); + + if (rv) + return rv; } if (dv->disposition == 'M') { if (verbose > 0) |