7/19

[Joe Thornber]

There's a bug in the dm-stripe.c constructor failing top check if enough
destinations are handed in. [Heinz Mauelshagen]
--- diff/drivers/md/dm-stripe.c	2002-12-16 09:40:48.000000000 +0000
+++ source/drivers/md/dm-stripe.c	2002-12-16 09:40:53.000000000 +0000
@@ -131,6 +131,15 @@
 		return -EINVAL;
 	}
 
+	/*
+	 * Do we have enough arguments for that many stripes ?
+	 */
+	if (argc != (2 + 2 * stripes)) {
+		ti->error = "dm-stripe: Not enough destinations "
+			"specified";
+		return -EINVAL;
+	}
+
 	sc = alloc_context(stripes);
 	if (!sc) {
 		ti->error = "dm-stripe: Memory allocation for striped context "
@@ -151,13 +160,6 @@
 	 * Get the stripe destinations.
 	 */
 	for (i = 0; i < stripes; i++) {
-		if (argc < 2) {
-			ti->error = "dm-stripe: Not enough destinations "
-				"specified";
-			kfree(sc);
-			return -EINVAL;
-		}
-
 		argv += 2;
 
 		r = get_stripe(ti, sc, i, argv);