Commit fdb1335a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'md-3.5-fixes' of git://neil.brown.name/md 

Pull use-after-free RAID1 bugfix from NeilBrown.

* tag 'md-3.5-fixes' of git://neil.brown.name/md:
  md/raid1: fix use-after-free bug in RAID1 data-check code.
parents d55e5bd0 2d4f4f33

drivers/md/raid1.c

+2 −1
Original line number Diff line number Diff line
@@ -2485,9 +2485,10 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr, int *skipp 
	 */

	if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {

		atomic_set(&r1_bio->remaining, read_targets);

		for (i = 0; i < conf->raid_disks * 2; i++) {

		for (i = 0; i < conf->raid_disks * 2 && read_targets; i++) {

			bio = r1_bio->bios[i];

			if (bio->bi_end_io == end_sync_read) {

				read_targets--;

				md_sync_acct(bio->bi_bdev, nr_sectors);

				generic_make_request(bio);

			}