Commit 284ae7ca authored by NeilBrown's avatar NeilBrown Committed by Linus Torvalds

[PATCH] md: Handle overflow of mdu_array_info_t->size better

mdu_array_info_t->size is 'int', which isn't big enough for the size (in KB of
each component in) some arrays.

So rather than a random overflow, set size to -1 when it cannot be set
correctly.

To update aspect on an array, userspace will sometimes:
  get_array_info
  change one field
  set_array_info

in this case, we don't want the '-1' in 'size' to change to size, or look like
a size change at all.  So test for that in update_array_info.
Signed-off-by: default avatarNeil Brown <neilb@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent ab11f899
...@@ -2942,6 +2942,8 @@ static int get_array_info(mddev_t * mddev, void __user * arg) ...@@ -2942,6 +2942,8 @@ static int get_array_info(mddev_t * mddev, void __user * arg)
info.ctime = mddev->ctime; info.ctime = mddev->ctime;
info.level = mddev->level; info.level = mddev->level;
info.size = mddev->size; info.size = mddev->size;
if (info.size != mddev->size) /* overflow */
info.size = -1;
info.nr_disks = nr; info.nr_disks = nr;
info.raid_disks = mddev->raid_disks; info.raid_disks = mddev->raid_disks;
info.md_minor = mddev->md_minor; info.md_minor = mddev->md_minor;
...@@ -3523,7 +3525,7 @@ static int update_array_info(mddev_t *mddev, mdu_array_info_t *info) ...@@ -3523,7 +3525,7 @@ static int update_array_info(mddev_t *mddev, mdu_array_info_t *info)
) )
return -EINVAL; return -EINVAL;
/* Check there is only one change */ /* Check there is only one change */
if (mddev->size != info->size) cnt++; if (info->size >= 0 && mddev->size != info->size) cnt++;
if (mddev->raid_disks != info->raid_disks) cnt++; if (mddev->raid_disks != info->raid_disks) cnt++;
if (mddev->layout != info->layout) cnt++; if (mddev->layout != info->layout) cnt++;
if ((state ^ info->state) & (1<<MD_SB_BITMAP_PRESENT)) cnt++; if ((state ^ info->state) & (1<<MD_SB_BITMAP_PRESENT)) cnt++;
...@@ -3540,7 +3542,7 @@ static int update_array_info(mddev_t *mddev, mdu_array_info_t *info) ...@@ -3540,7 +3542,7 @@ static int update_array_info(mddev_t *mddev, mdu_array_info_t *info)
else else
return mddev->pers->reconfig(mddev, info->layout, -1); return mddev->pers->reconfig(mddev, info->layout, -1);
} }
if (mddev->size != info->size) if (info->size >= 0 && mddev->size != info->size)
rv = update_size(mddev, info->size); rv = update_size(mddev, info->size);
if (mddev->raid_disks != info->raid_disks) if (mddev->raid_disks != info->raid_disks)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment