[PATCH 1/2 V1] md:Avoid write invalid address if read_seqretry returned true.

[PATCH 1/2 V1] md:Avoid write invalid address if read_seqretry returned true.

[majianpeng]

Hi Neil,
	I updated this patch.There are two place to changed
1:The previous patch omit the parameter 'p'
2:Using p[i] instead of *p++; bbp[i] instead *bbp++.It make the code looks better.
After rewriting ,i tested and it looked good.


If read_seqretry returned true and bbp was changed, it will write
invalid address which can cause some serious problem.

This bug was introduced by commit v3.0-rc7-130-g2699b67.
So fix is suitable for 3.0.y thru 3.6.y.

Reported-by: zhuwenfeng@kedacom.com
Tested-by: zhuwenfeng@kedacom.com
Cc: stable@vger.kernel.org
Signed-off-by: Jianpeng Ma <majianpeng@gmail.com>
---
 drivers/md/md.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 9ab768a..1f86c48 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1817,10 +1817,10 @@ retry:
 			memset(bbp, 0xff, PAGE_SIZE);
 
 			for (i = 0 ; i < bb->count ; i++) {
-				u64 internal_bb = *p++;
+				u64 internal_bb = p[i];
 				u64 store_bb = ((BB_OFFSET(internal_bb) << 10)
 						| BB_LEN(internal_bb));
-				*bbp++ = cpu_to_le64(store_bb);
+				bbp[i] = cpu_to_le64(store_bb);
 			}
 			bb->changed = 0;
 			if (read_seqretry(&bb->lock, seq))
-- 
1.7.9.5

Re: [PATCH 1/2 V1] md:Avoid write invalid address if read_seqretry returned true.

[NeilBrown]

[-- Attachment #1: Type: text/plain, Size: 1496 bytes --]

On Thu, 8 Nov 2012 08:56:27 +0800 majianpeng <majianpeng@gmail.com> wrote:

> Hi Neil,
> 	I updated this patch.There are two place to changed
> 1:The previous patch omit the parameter 'p'
> 2:Using p[i] instead of *p++; bbp[i] instead *bbp++.It make the code looks better.
> After rewriting ,i tested and it looked good.
> 
> 
> If read_seqretry returned true and bbp was changed, it will write
> invalid address which can cause some serious problem.
> 
> This bug was introduced by commit v3.0-rc7-130-g2699b67.
> So fix is suitable for 3.0.y thru 3.6.y.
> 
> Reported-by: zhuwenfeng@kedacom.com
> Tested-by: zhuwenfeng@kedacom.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Jianpeng Ma <majianpeng@gmail.com>
> ---
>  drivers/md/md.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 9ab768a..1f86c48 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -1817,10 +1817,10 @@ retry:
>  			memset(bbp, 0xff, PAGE_SIZE);
>  
>  			for (i = 0 ; i < bb->count ; i++) {
> -				u64 internal_bb = *p++;
> +				u64 internal_bb = p[i];
>  				u64 store_bb = ((BB_OFFSET(internal_bb) << 10)
>  						| BB_LEN(internal_bb));
> -				*bbp++ = cpu_to_le64(store_bb);
> +				bbp[i] = cpu_to_le64(store_bb);
>  			}
>  			bb->changed = 0;
>  			if (read_seqretry(&bb->lock, seq))

Yes, that does look cleaner.  Thanks.

Applied in place of the previous version.

Thanks,
NeilBrown

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 828 bytes --]