* [PATCH 1/2 V1] md:Avoid write invalid address if read_seqretry returned true.
@ 2012-11-08 0:56 majianpeng
2012-11-19 1:31 ` NeilBrown
0 siblings, 1 reply; 2+ messages in thread
From: majianpeng @ 2012-11-08 0:56 UTC (permalink / raw)
To: NeilBrown; +Cc: linux-raid, zhuwenfeng
Hi Neil,
I updated this patch.There are two place to changed
1:The previous patch omit the parameter 'p'
2:Using p[i] instead of *p++; bbp[i] instead *bbp++.It make the code looks better.
After rewriting ,i tested and it looked good.
If read_seqretry returned true and bbp was changed, it will write
invalid address which can cause some serious problem.
This bug was introduced by commit v3.0-rc7-130-g2699b67.
So fix is suitable for 3.0.y thru 3.6.y.
Reported-by: zhuwenfeng@kedacom.com
Tested-by: zhuwenfeng@kedacom.com
Cc: stable@vger.kernel.org
Signed-off-by: Jianpeng Ma <majianpeng@gmail.com>
---
drivers/md/md.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 9ab768a..1f86c48 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1817,10 +1817,10 @@ retry:
memset(bbp, 0xff, PAGE_SIZE);
for (i = 0 ; i < bb->count ; i++) {
- u64 internal_bb = *p++;
+ u64 internal_bb = p[i];
u64 store_bb = ((BB_OFFSET(internal_bb) << 10)
| BB_LEN(internal_bb));
- *bbp++ = cpu_to_le64(store_bb);
+ bbp[i] = cpu_to_le64(store_bb);
}
bb->changed = 0;
if (read_seqretry(&bb->lock, seq))
--
1.7.9.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 1/2 V1] md:Avoid write invalid address if read_seqretry returned true.
2012-11-08 0:56 [PATCH 1/2 V1] md:Avoid write invalid address if read_seqretry returned true majianpeng
@ 2012-11-19 1:31 ` NeilBrown
0 siblings, 0 replies; 2+ messages in thread
From: NeilBrown @ 2012-11-19 1:31 UTC (permalink / raw)
To: majianpeng; +Cc: linux-raid, zhuwenfeng
[-- Attachment #1: Type: text/plain, Size: 1496 bytes --]
On Thu, 8 Nov 2012 08:56:27 +0800 majianpeng <majianpeng@gmail.com> wrote:
> Hi Neil,
> I updated this patch.There are two place to changed
> 1:The previous patch omit the parameter 'p'
> 2:Using p[i] instead of *p++; bbp[i] instead *bbp++.It make the code looks better.
> After rewriting ,i tested and it looked good.
>
>
> If read_seqretry returned true and bbp was changed, it will write
> invalid address which can cause some serious problem.
>
> This bug was introduced by commit v3.0-rc7-130-g2699b67.
> So fix is suitable for 3.0.y thru 3.6.y.
>
> Reported-by: zhuwenfeng@kedacom.com
> Tested-by: zhuwenfeng@kedacom.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Jianpeng Ma <majianpeng@gmail.com>
> ---
> drivers/md/md.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 9ab768a..1f86c48 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -1817,10 +1817,10 @@ retry:
> memset(bbp, 0xff, PAGE_SIZE);
>
> for (i = 0 ; i < bb->count ; i++) {
> - u64 internal_bb = *p++;
> + u64 internal_bb = p[i];
> u64 store_bb = ((BB_OFFSET(internal_bb) << 10)
> | BB_LEN(internal_bb));
> - *bbp++ = cpu_to_le64(store_bb);
> + bbp[i] = cpu_to_le64(store_bb);
> }
> bb->changed = 0;
> if (read_seqretry(&bb->lock, seq))
Yes, that does look cleaner. Thanks.
Applied in place of the previous version.
Thanks,
NeilBrown
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 828 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-11-19 1:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-11-08 0:56 [PATCH 1/2 V1] md:Avoid write invalid address if read_seqretry returned true majianpeng
2012-11-19 1:31 ` NeilBrown
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).