On Thu, 29 Nov 2012 12:40:52 -0800 <[email protected]> wrote:
> > The patch below does not apply to the 3.0-stable tree. > If someone wants it applied there, or to any other stable or longterm > tree, then please email the backport, including the original git commit > id to <[email protected]>. As with other patch, this one should have been marked for 3.1.y onwards, not 3.0.y. sorry. NeilBrown > > thanks, > > greg k-h > > ------------------ original commit in Linus's tree ------------------ > > >From 35f9ac2dcec8f79d7059ce174fd7b7ee3290d620 Mon Sep 17 00:00:00 2001 > From: majianpeng <[email protected]> > Date: Thu, 8 Nov 2012 08:56:27 +0800 > Subject: [PATCH] md: Avoid write invalid address if read_seqretry returned > true. > > If read_seqretry returned true and bbp was changed, it will write > invalid address which can cause some serious problem. > > This bug was introduced by commit v3.0-rc7-130-g2699b67. > So fix is suitable for 3.0.y thru 3.6.y. > > Reported-by: [email protected] > Tested-by: [email protected] > Cc: [email protected] > Signed-off-by: Jianpeng Ma <[email protected]> > Signed-off-by: NeilBrown <[email protected]> > > diff --git a/drivers/md/md.c b/drivers/md/md.c > index 14db6ab..4c7d880 100644 > --- a/drivers/md/md.c > +++ b/drivers/md/md.c > @@ -1817,10 +1817,10 @@ retry: > memset(bbp, 0xff, PAGE_SIZE); > > for (i = 0 ; i < bb->count ; i++) { > - u64 internal_bb = *p++; > + u64 internal_bb = p[i]; > u64 store_bb = ((BB_OFFSET(internal_bb) << 10) > | BB_LEN(internal_bb)); > - *bbp++ = cpu_to_le64(store_bb); > + bbp[i] = cpu_to_le64(store_bb); > } > bb->changed = 0; > if (read_seqretry(&bb->lock, seq))
signature.asc
Description: PGP signature
