diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2008-12-19 11:34:36 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-12-19 11:34:36 -0800 |
| commit | db873cfc7c0a6f34ab0f1c811fc245273adf35af (patch) | |
| tree | 53b28b8a53f266cf4ca7967c5c0723b09d4b8307 /drivers | |
| parent | eae34c67940f2a71837ed30d571b93572186d46b (diff) | |
| parent | a2ed9615e3222645007fc19991aedf30eed3ecfd (diff) | |
| download | linux-3.10-db873cfc7c0a6f34ab0f1c811fc245273adf35af.tar.gz linux-3.10-db873cfc7c0a6f34ab0f1c811fc245273adf35af.tar.bz2 linux-3.10-db873cfc7c0a6f34ab0f1c811fc245273adf35af.zip | |
Merge branch 'for-linus' of git://neil.brown.name/md
* 'for-linus' of git://neil.brown.name/md:
md: Don't read past end of bitmap when reading bitmap.
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/md/bitmap.c | 22 |
1 files changed, 17 insertions, 5 deletions
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c index ac89a5deaca..ab7c8e4a61f 100644 --- a/drivers/md/bitmap.c +++ b/drivers/md/bitmap.c @@ -208,16 +208,19 @@ static void bitmap_checkfree(struct bitmap *bitmap, unsigned long page) */ /* IO operations when bitmap is stored near all superblocks */ -static struct page *read_sb_page(mddev_t *mddev, long offset, unsigned long index) +static struct page *read_sb_page(mddev_t *mddev, long offset, + struct page *page, + unsigned long index, int size) { /* choose a good rdev and read the page from there */ mdk_rdev_t *rdev; struct list_head *tmp; - struct page *page = alloc_page(GFP_KERNEL); sector_t target; if (!page) + page = alloc_page(GFP_KERNEL); + if (!page) return ERR_PTR(-ENOMEM); rdev_for_each(rdev, tmp, mddev) { @@ -227,7 +230,9 @@ static struct page *read_sb_page(mddev_t *mddev, long offset, unsigned long inde target = rdev->sb_start + offset + index * (PAGE_SIZE/512); - if (sync_page_io(rdev->bdev, target, PAGE_SIZE, page, READ)) { + if (sync_page_io(rdev->bdev, target, + roundup(size, bdev_hardsect_size(rdev->bdev)), + page, READ)) { page->index = index; attach_page_buffers(page, NULL); /* so that free_buffer will * quietly no-op */ @@ -544,7 +549,9 @@ static int bitmap_read_sb(struct bitmap *bitmap) bitmap->sb_page = read_page(bitmap->file, 0, bitmap, bytes); } else { - bitmap->sb_page = read_sb_page(bitmap->mddev, bitmap->offset, 0); + bitmap->sb_page = read_sb_page(bitmap->mddev, bitmap->offset, + NULL, + 0, sizeof(bitmap_super_t)); } if (IS_ERR(bitmap->sb_page)) { err = PTR_ERR(bitmap->sb_page); @@ -957,11 +964,16 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start) */ page = bitmap->sb_page; offset = sizeof(bitmap_super_t); + read_sb_page(bitmap->mddev, bitmap->offset, + page, + index, count); } else if (file) { page = read_page(file, index, bitmap, count); offset = 0; } else { - page = read_sb_page(bitmap->mddev, bitmap->offset, index); + page = read_sb_page(bitmap->mddev, bitmap->offset, + NULL, + index, count); offset = 0; } if (IS_ERR(page)) { /* read error */ |