[PATCH] md: fix possible problem in raid1/raid10 error overwriting

The code to overwrite/reread for addressing read errors in raid1/raid10
currently assumes that the read will not alter the buffer which could be used
to write to the next device.  This is not a safe assumption to make.

So we split the loops into a overwrite loop and a separate re-read loop, so
that the writing is complete before reading is attempted.

Cc: Paul Clements <paul.clements@steeleye.com>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 18 insertions, 4 deletions

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index f23d52c5df94..9647ebb0983a 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1421,6 +1421,7 @@ static void raid10d(mddev_t *mddev)
                                 } while (!success && sl != r10_bio->read_slot);
 
                                 if (success) {
+                                        int start = sl;
                                         /* write it back and re-read */
                                         while (sl != r10_bio->read_slot) {
                                                 int d;
@@ -1434,14 +1435,27 @@ static void raid10d(mddev_t *mddev)
                                                         if (sync_page_io(rdev->bdev,
                                                                          r10_bio->devs[sl].addr +
                                                                          sect + rdev->data_offset,
-                                                                         s<<9, conf->tmppage, WRITE) == 0 ||
-                                                            sync_page_io(rdev->bdev,
+                                                                         s<<9, conf->tmppage, WRITE) == 0)
+                                                                /* Well, this device is dead */
+                                                                md_error(mddev, rdev);
+                                                }
+                                        }
+                                        sl = start;
+                                        while (sl != r10_bio->read_slot) {
+                                                int d;
+                                                if (sl==0)
+                                                        sl = conf->copies;
+                                                sl--;
+                                                d = r10_bio->devs[sl].devnum;
+                                                rdev = conf->mirrors[d].rdev;
+                                                if (rdev &&
+                                                    test_bit(In_sync, &rdev->flags)) {
+                                                        if (sync_page_io(rdev->bdev,
                                                                          r10_bio->devs[sl].addr +
                                                                          sect + rdev->data_offset,
-                                                                         s<<9, conf->tmppage, READ) == 0) {
+                                                                         s<<9, conf->tmppage, READ) == 0)
                                                                 /* Well, this device is dead */
                                                                 md_error(mddev, rdev);
-                                                        }
                                                 }
                                         }
                                 } else {