Prev: [074/200] drm/radeon/kms: reset ddc_bus in object header parsing
Next: [042/200] USB: ir-usb: fix double free
From: Greg KH on 1 Jul 2010 18:00
2.6.34-stable review patch. If anyone has any objections, please let me know.

------------------

From: NeilBrown <neilb(a)suse.de>

commit af3a2cd6b8a479345786e7fe5e199ad2f6240e56 upstream.

read_balance uses a "unsigned long" for a sector number which
will get truncated beyond 2TB.
This will cause read-balancing to be non-optimal, and can cause
data to be read from the 'wrong' branch during a resync. This has a
very small chance of returning wrong data.

Reported-by: Jordan Russell <jr-list-2010(a)quo.to>
Signed-off-by: NeilBrown <neilb(a)suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de>

---
drivers/md/raid1.c | 4 ++--
drivers/md/raid10.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -418,7 +418,7 @@ static void raid1_end_write_request(stru
*/
static int read_balance(conf_t *conf, r1bio_t *r1_bio)
{
- const unsigned long this_sector = r1_bio->sector;
+ const sector_t this_sector = r1_bio->sector;
int new_disk = conf->last_used, disk = new_disk;
int wonly_disk = -1;
const int sectors = r1_bio->sectors;
@@ -434,7 +434,7 @@ static int read_balance(conf_t *conf, r1
retry:
if (conf->mddev->recovery_cp < MaxSector &&
(this_sector + sectors >= conf->next_resync)) {
- /* Choose the first operation device, for consistancy */
+ /* Choose the first operational device, for consistancy */
new_disk = 0;

for (rdev = rcu_dereference(conf->mirrors[new_disk].rdev);
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -494,7 +494,7 @@ static int raid10_mergeable_bvec(struct
*/
static int read_balance(conf_t *conf, r10bio_t *r10_bio)
{
- const unsigned long this_sector = r10_bio->sector;
+ const sector_t this_sector = r10_bio->sector;
int disk, slot, nslot;
const int sectors = r10_bio->sectors;
sector_t new_distance, current_distance;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: [074/200] drm/radeon/kms: reset ddc_bus in object header parsing
Next: [042/200] USB: ir-usb: fix double free