[PATCH] md: Fix device-size updates in md

As 'array_size' is a 'sector_t', it may overflow inappropriately when shifted
10 bits.  So We should cast it to a loff_t first.

There are two places with this problem, but the second (in update_raid_disks)
isn't needed so just remove it:
  The only personality that handles ->reshape currently is raid1,
  and it doesn't change the size of the array.
  When added for raid5/6, reshape again won't change the size of the array,
  at least not straight away.
  This code might be need for reshaping 'linear' but linear->shape,
  if implemented, should probably do the i_size_write itself.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 1 insertions, 12 deletions

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 7145cd150f7b..9fac8ac496c5 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3465,7 +3465,7 @@ static int update_size(mddev_t *mddev, unsigned long size)
                 bdev = bdget_disk(mddev->gendisk, 0);
                 if (bdev) {
                         mutex_lock(&bdev->bd_inode->i_mutex);
-                        i_size_write(bdev->bd_inode, mddev->array_size << 10);
+                        i_size_write(bdev->bd_inode, (loff_t)mddev->array_size << 10);
                         mutex_unlock(&bdev->bd_inode->i_mutex);
                         bdput(bdev);
                 }
@@ -3485,17 +3485,6 @@ static int update_raid_disks(mddev_t *mddev, int raid_disks)
         if (mddev->sync_thread)
                 return -EBUSY;
         rv = mddev->pers->reshape(mddev, raid_disks);
-        if (!rv) {
-                struct block_device *bdev;
-
-                bdev = bdget_disk(mddev->gendisk, 0);
-                if (bdev) {
-                        mutex_lock(&bdev->bd_inode->i_mutex);
-                        i_size_write(bdev->bd_inode, mddev->array_size << 10);
-                        mutex_unlock(&bdev->bd_inode->i_mutex);
-                        bdput(bdev);
-                }
-        }
         return rv;
 }