Skip to content

Commit 4e6b6ee

Browse files
committed
Merge tag 'md/4.2-rc5-fixes' of git://neil.brown.name/md
Pull md fixes from Neil Brown: "Three more fixes for md in 4.2 Mostly corner-case stuff. One of these patches is for a CVE: CVE-2015-5697 I'm not convinced it is serious (data leak from CAP_SYS_ADMIN ioctl) but as people seem to want to back-port it, I've included a minimal version here. The remainder of that patch from Benjamin is code-cleanup and will arrive in the 4.3 merge window" * tag 'md/4.2-rc5-fixes' of git://neil.brown.name/md: md/raid5: don't let shrink_slab shrink too far. md: use kzalloc() when bitmap is disabled md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies
2 parents 9e91edc + 49895bc commit 4e6b6ee

File tree

3 files changed

+10
-7
lines changed

3 files changed

+10
-7
lines changed

drivers/md/md.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5759,7 +5759,7 @@ static int get_bitmap_file(struct mddev *mddev, void __user * arg)
57595759
char *ptr;
57605760
int err;
57615761

5762-
file = kmalloc(sizeof(*file), GFP_NOIO);
5762+
file = kzalloc(sizeof(*file), GFP_NOIO);
57635763
if (!file)
57645764
return -ENOMEM;
57655765

drivers/md/raid1.c

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1476,6 +1476,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
14761476
{
14771477
char b[BDEVNAME_SIZE];
14781478
struct r1conf *conf = mddev->private;
1479+
unsigned long flags;
14791480

14801481
/*
14811482
* If it is not operational, then we have already marked it as dead
@@ -1495,14 +1496,13 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
14951496
return;
14961497
}
14971498
set_bit(Blocked, &rdev->flags);
1499+
spin_lock_irqsave(&conf->device_lock, flags);
14981500
if (test_and_clear_bit(In_sync, &rdev->flags)) {
1499-
unsigned long flags;
1500-
spin_lock_irqsave(&conf->device_lock, flags);
15011501
mddev->degraded++;
15021502
set_bit(Faulty, &rdev->flags);
1503-
spin_unlock_irqrestore(&conf->device_lock, flags);
15041503
} else
15051504
set_bit(Faulty, &rdev->flags);
1505+
spin_unlock_irqrestore(&conf->device_lock, flags);
15061506
/*
15071507
* if recovery is running, make sure it aborts.
15081508
*/
@@ -1568,7 +1568,10 @@ static int raid1_spare_active(struct mddev *mddev)
15681568
* Find all failed disks within the RAID1 configuration
15691569
* and mark them readable.
15701570
* Called under mddev lock, so rcu protection not needed.
1571+
* device_lock used to avoid races with raid1_end_read_request
1572+
* which expects 'In_sync' flags and ->degraded to be consistent.
15711573
*/
1574+
spin_lock_irqsave(&conf->device_lock, flags);
15721575
for (i = 0; i < conf->raid_disks; i++) {
15731576
struct md_rdev *rdev = conf->mirrors[i].rdev;
15741577
struct md_rdev *repl = conf->mirrors[conf->raid_disks + i].rdev;
@@ -1599,7 +1602,6 @@ static int raid1_spare_active(struct mddev *mddev)
15991602
sysfs_notify_dirent_safe(rdev->sysfs_state);
16001603
}
16011604
}
1602-
spin_lock_irqsave(&conf->device_lock, flags);
16031605
mddev->degraded -= count;
16041606
spin_unlock_irqrestore(&conf->device_lock, flags);
16051607

drivers/md/raid5.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2256,7 +2256,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
22562256
static int drop_one_stripe(struct r5conf *conf)
22572257
{
22582258
struct stripe_head *sh;
2259-
int hash = (conf->max_nr_stripes - 1) % NR_STRIPE_HASH_LOCKS;
2259+
int hash = (conf->max_nr_stripes - 1) & STRIPE_HASH_LOCKS_MASK;
22602260

22612261
spin_lock_irq(conf->hash_locks + hash);
22622262
sh = get_free_stripe(conf, hash);
@@ -6388,7 +6388,8 @@ static unsigned long raid5_cache_scan(struct shrinker *shrink,
63886388

63896389
if (mutex_trylock(&conf->cache_size_mutex)) {
63906390
ret= 0;
6391-
while (ret < sc->nr_to_scan) {
6391+
while (ret < sc->nr_to_scan &&
6392+
conf->max_nr_stripes > conf->min_nr_stripes) {
63926393
if (drop_one_stripe(conf) == 0) {
63936394
ret = SHRINK_STOP;
63946395
break;

0 commit comments

Comments
 (0)