diff options
| author | Linus Torvalds | 2012-07-14 02:59:33 +0200 |
|---|---|---|
| committer | Linus Torvalds | 2012-07-14 02:59:33 +0200 |
| commit | fdb1335a82ef1ef9442ac9377796e4e7a69d1ae4 (patch) | |
| tree | e661a91753398208d338a089f45e00530475f721 | |
| parent | Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/... (diff) | |
| parent | md/raid1: fix use-after-free bug in RAID1 data-check code. (diff) | |
| download | kernel-qcow2-linux-fdb1335a82ef1ef9442ac9377796e4e7a69d1ae4.tar.gz kernel-qcow2-linux-fdb1335a82ef1ef9442ac9377796e4e7a69d1ae4.tar.xz kernel-qcow2-linux-fdb1335a82ef1ef9442ac9377796e4e7a69d1ae4.zip | |
Merge tag 'md-3.5-fixes' of git://neil.brown.name/md
Pull use-after-free RAID1 bugfix from NeilBrown.
* tag 'md-3.5-fixes' of git://neil.brown.name/md:
md/raid1: fix use-after-free bug in RAID1 data-check code.
| -rw-r--r-- | drivers/md/raid1.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 8c2754f835ef..240ff3125040 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -2485,9 +2485,10 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr, int *skipp */ if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) { atomic_set(&r1_bio->remaining, read_targets); - for (i = 0; i < conf->raid_disks * 2; i++) { + for (i = 0; i < conf->raid_disks * 2 && read_targets; i++) { bio = r1_bio->bios[i]; if (bio->bi_end_io == end_sync_read) { + read_targets--; md_sync_acct(bio->bi_bdev, nr_sectors); generic_make_request(bio); } |