Unverified Commit db05731a authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15815 dm raid: fix accesses beyond end of raid member array 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yuan Can <yuancan@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/JPSQASNDIRLDA565UUMPV2AA6M3OK4WK/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBP60S 
 
Link:https://gitee.com/openeuler/kernel/pulls/15815

 

Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 207cd63d 4c995612

drivers/md/dm-raid.c

+18 −16
Original line number Diff line number Diff line
@@ -998,12 +998,13 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size) 
static int validate_raid_redundancy(struct raid_set *rs)

{

	unsigned int i, rebuild_cnt = 0;

	unsigned int rebuilds_per_group = 0, copies;

	unsigned int rebuilds_per_group = 0, copies, raid_disks;

	unsigned int group_size, last_group_start;



	for (i = 0; i < rs->md.raid_disks; i++)

		if (!test_bit(In_sync, &rs->dev[i].rdev.flags) ||

		    !rs->dev[i].rdev.sb_page)

	for (i = 0; i < rs->raid_disks; i++)

		if (!test_bit(FirstUse, &rs->dev[i].rdev.flags) &&

		    ((!test_bit(In_sync, &rs->dev[i].rdev.flags) ||

		      !rs->dev[i].rdev.sb_page)))

			rebuild_cnt++;



	switch (rs->md.level) {
@@ -1043,8 +1044,9 @@ static int validate_raid_redundancy(struct raid_set *rs) 
		 *	    A	 A    B	   B	C

		 *	    C	 D    D	   E	E

		 */

		raid_disks = min(rs->raid_disks, rs->md.raid_disks);

		if (__is_raid10_near(rs->md.new_layout)) {

			for (i = 0; i < rs->md.raid_disks; i++) {

			for (i = 0; i < raid_disks; i++) {

				if (!(i % copies))

					rebuilds_per_group = 0;

				if ((!rs->dev[i].rdev.sb_page ||
@@ -1067,10 +1069,10 @@ static int validate_raid_redundancy(struct raid_set *rs) 
		 * results in the need to treat the last (potentially larger)

		 * set differently.

		 */

		group_size = (rs->md.raid_disks / copies);

		last_group_start = (rs->md.raid_disks / group_size) - 1;

		group_size = (raid_disks / copies);

		last_group_start = (raid_disks / group_size) - 1;

		last_group_start *= group_size;

		for (i = 0; i < rs->md.raid_disks; i++) {

		for (i = 0; i < raid_disks; i++) {

			if (!(i % copies) && !(i > last_group_start))

				rebuilds_per_group = 0;

			if ((!rs->dev[i].rdev.sb_page ||
@@ -1585,7 +1587,7 @@ static sector_t __rdev_sectors(struct raid_set *rs) 
{

	int i;



	for (i = 0; i < rs->md.raid_disks; i++) {

	for (i = 0; i < rs->raid_disks; i++) {

		struct md_rdev *rdev = &rs->dev[i].rdev;



		if (!test_bit(Journal, &rdev->flags) &&
@@ -3748,13 +3750,13 @@ static int raid_iterate_devices(struct dm_target *ti, 
	unsigned int i;

	int r = 0;



	for (i = 0; !r && i < rs->md.raid_disks; i++)

		if (rs->dev[i].data_dev)

			r = fn(ti,

				 rs->dev[i].data_dev,

	for (i = 0; !r && i < rs->raid_disks; i++) {

		if (rs->dev[i].data_dev) {

			r = fn(ti, rs->dev[i].data_dev,

			       0, /* No offset on data devs */

				 rs->md.dev_sectors,

				 data);

			       rs->md.dev_sectors, data);

		}

	}



	return r;

}