Commit 78eaa0d4 authored by NeilBrown's avatar NeilBrown

md/raid10: fix two bugs affecting RAID10 reshape.

1/ If a RAID10 is being reshaped to a fewer number of devices
 and is stopped while this is ongoing, then when the array is
 reassembled the 'mirrors' array will be allocated too small.
 This will lead to an access error or memory corruption.

2/ A sanity test for a reshaping RAID10 array is restarted
 is slightly incorrect.

Due to the first bug, this is suitable for any -stable
kernel since 3.5 where this code was introduced.

Cc: stable@vger.kernel.org (v3.5+)
Signed-off-by: default avatarNeilBrown <neilb@suse.de>
parent 0baac4db
...@@ -3554,7 +3554,7 @@ static struct r10conf *setup_conf(struct mddev *mddev) ...@@ -3554,7 +3554,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
/* FIXME calc properly */ /* FIXME calc properly */
conf->mirrors = kzalloc(sizeof(struct raid10_info)*(mddev->raid_disks + conf->mirrors = kzalloc(sizeof(struct raid10_info)*(mddev->raid_disks +
max(0,mddev->delta_disks)), max(0,-mddev->delta_disks)),
GFP_KERNEL); GFP_KERNEL);
if (!conf->mirrors) if (!conf->mirrors)
goto out; goto out;
...@@ -3713,7 +3713,7 @@ static int run(struct mddev *mddev) ...@@ -3713,7 +3713,7 @@ static int run(struct mddev *mddev)
conf->geo.far_offset == 0) conf->geo.far_offset == 0)
goto out_free_conf; goto out_free_conf;
if (conf->prev.far_copies != 1 && if (conf->prev.far_copies != 1 &&
conf->geo.far_offset == 0) conf->prev.far_offset == 0)
goto out_free_conf; goto out_free_conf;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment