Patch name: md-allow-analyze_sbs-to-fail.patch
Catch the case that md_run is called requiring non-existant super_types fns.
Other modules may call md_run (like device-mapper's, dm-raid.c), we mustn't
assume they will always set a valid MD major_version. This is especially true
in the case of device-mapper, which will use a new superblock type. If patches
don't land in the kernel in the proper order, access will be attempted beyond
the end of the super_types array.
Signed-off-by: Jonathan Brassow <jbrassow@xxxxxxxxxx>
Index: linux-2.6/drivers/md/md.c
===================================================================
--- linux-2.6.orig/drivers/md/md.c
+++ linux-2.6/drivers/md/md.c
@@ -2864,12 +2864,15 @@ abort_free:
*/
-static void analyze_sbs(mddev_t * mddev)
+static int analyze_sbs(mddev_t *mddev)
{
int i;
mdk_rdev_t *rdev, *freshest, *tmp;
char b[BDEVNAME_SIZE];
+ if (mddev->major_version >= ARRAY_SIZE(super_types))
+ return -EINVAL;
+
freshest = NULL;
rdev_for_each(rdev, tmp, mddev)
switch (super_types[mddev->major_version].
@@ -2921,6 +2924,7 @@ static void analyze_sbs(mddev_t * mddev)
clear_bit(In_sync, &rdev->flags);
}
}
+ return 0;
}
/* Read a fixed-point number.
@@ -4459,7 +4463,8 @@ int md_run(mddev_t *mddev)
if (should_read_super(mddev)) {
if (!mddev->persistent)
return -EINVAL;
- analyze_sbs(mddev);
+ if (analyze_sbs(mddev))
+ return -EINVAL;
}
if (mddev->level != LEVEL_NONE)
--
To unsubscribe from this list: send the line "unsubscribe linux-raid" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
