aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorNeilBrown <neilb@suse.de>2008-03-04 17:29:31 -0500
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2008-03-04 19:35:17 -0500
commita1801f858e57f87a7f79914346921cc729632295 (patch)
tree1ac8c153af0512382c387316a6882df555eb721e /drivers
parent8311c29d40235062a843f4a8e8a70a44af6fe4c9 (diff)
md: guard against possible bad array geometry in v1 metadata
Make sure the data doesn't start before the end of the superblock when the superblock is at the start of the device. Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/md/md.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 7da6ec244e15..b375de5c1af2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1105,7 +1105,11 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
1105 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256; 1105 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
1106 bmask = queue_hardsect_size(rdev->bdev->bd_disk->queue)-1; 1106 bmask = queue_hardsect_size(rdev->bdev->bd_disk->queue)-1;
1107 if (rdev->sb_size & bmask) 1107 if (rdev->sb_size & bmask)
1108 rdev-> sb_size = (rdev->sb_size | bmask)+1; 1108 rdev->sb_size = (rdev->sb_size | bmask) + 1;
1109
1110 if (minor_version
1111 && rdev->data_offset < sb_offset + (rdev->sb_size/512))
1112 return -EINVAL;
1109 1113
1110 if (sb->level == cpu_to_le32(LEVEL_MULTIPATH)) 1114 if (sb->level == cpu_to_le32(LEVEL_MULTIPATH))
1111 rdev->desc_nr = -1; 1115 rdev->desc_nr = -1;
@@ -1137,7 +1141,7 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
1137 else 1141 else
1138 ret = 0; 1142 ret = 0;
1139 } 1143 }
1140 if (minor_version) 1144 if (minor_version)
1141 rdev->size = ((rdev->bdev->bd_inode->i_size>>9) - le64_to_cpu(sb->data_offset)) / 2; 1145 rdev->size = ((rdev->bdev->bd_inode->i_size>>9) - le64_to_cpu(sb->data_offset)) / 2;
1142 else 1146 else
1143 rdev->size = rdev->sb_offset; 1147 rdev->size = rdev->sb_offset;