There's a bug in the dm-stripe.c constructor failing top check if enough destinations are handed in. [Heinz Mauelshagen] --- diff/drivers/md/dm-stripe.c 2002-11-29 09:06:53.000000000 +0000 +++ source/drivers/md/dm-stripe.c 2002-11-29 09:07:05.000000000 +0000 @@ -130,6 +130,15 @@ return -EINVAL; } + /* + * Do we have enough arguments for that many stripes ? + */ + if (argc != (2 + 2 * stripes)) { + ti->error = "dm-stripe: Not enough destinations " + "specified"; + return -EINVAL; + } + sc = alloc_context(stripes); if (!sc) { ti->error = "dm-stripe: Memory allocation for striped context " @@ -149,13 +158,6 @@ * Get the stripe destinations. */ for (i = 0; i < stripes; i++) { - if (argc < 2) { - ti->error = "dm-stripe: Not enough destinations " - "specified"; - kfree(sc); - return -EINVAL; - } - argv += 2; r = get_stripe(ti, sc, i, argv);