Re: [PATCH 1/2 V1] md:Avoid write invalid address if read_seqretry returned true.

[NeilBrown <neilb@suse.de>]

[-- Attachment #1: Type: text/plain, Size: 1496 bytes --]

On Thu, 8 Nov 2012 08:56:27 +0800 majianpeng <majianpeng@gmail.com> wrote:

> Hi Neil,
> 	I updated this patch.There are two place to changed
> 1:The previous patch omit the parameter 'p'
> 2:Using p[i] instead of *p++; bbp[i] instead *bbp++.It make the code looks better.
> After rewriting ,i tested and it looked good.
> 
> 
> If read_seqretry returned true and bbp was changed, it will write
> invalid address which can cause some serious problem.
> 
> This bug was introduced by commit v3.0-rc7-130-g2699b67.
> So fix is suitable for 3.0.y thru 3.6.y.
> 
> Reported-by: zhuwenfeng@kedacom.com
> Tested-by: zhuwenfeng@kedacom.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Jianpeng Ma <majianpeng@gmail.com>
> ---
>  drivers/md/md.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 9ab768a..1f86c48 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -1817,10 +1817,10 @@ retry:
>  			memset(bbp, 0xff, PAGE_SIZE);
>  
>  			for (i = 0 ; i < bb->count ; i++) {
> -				u64 internal_bb = *p++;
> +				u64 internal_bb = p[i];
>  				u64 store_bb = ((BB_OFFSET(internal_bb) << 10)
>  						| BB_LEN(internal_bb));
> -				*bbp++ = cpu_to_le64(store_bb);
> +				bbp[i] = cpu_to_le64(store_bb);
>  			}
>  			bb->changed = 0;
>  			if (read_seqretry(&bb->lock, seq))

Yes, that does look cleaner.  Thanks.

Applied in place of the previous version.

Thanks,
NeilBrown

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 828 bytes --]