From: NeilBrown Date: Thu, 24 Sep 2015 05:25:36 +0000 (+1000) Subject: md/raid5: don't index beyond end of array in need_this_block(). X-Git-Tag: v4.1.12-104.0.20170618_1145~124 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=ec689db87bf24cc74234730c051580b8c63c47ee;p=users%2Fjedix%2Flinux-maple.git md/raid5: don't index beyond end of array in need_this_block(). When need_this_block probably shouldn't be called when there are more than 2 failed devices, we really don't want it to try indexing beyond the end of the failed_num[] of fdev[] arrays. So limit the loops to at most 2 iterations. Reported-by: Shaohua Li Signed-off-by: NeilBrown (cherry picked from commit 36707bb2e7c6730d79d6cdc6d1475d3d7e94c518) Orabug: 26047272 Signed-off-by: Fred Herard Reviewed-by: John Sobecki --- diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index ef0a99a3a779..71ecfad9a476 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -3309,7 +3309,7 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s, */ return 0; - for (i = 0; i < s->failed; i++) { + for (i = 0; i < s->failed && i < 2; i++) { if (fdev[i]->towrite && !test_bit(R5_UPTODATE, &fdev[i]->flags) && !test_bit(R5_OVERWRITE, &fdev[i]->flags)) @@ -3333,7 +3333,7 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s, sh->sector < sh->raid_conf->mddev->recovery_cp) /* reconstruct-write isn't being forced */ return 0; - for (i = 0; i < s->failed; i++) { + for (i = 0; i < s->failed && i < 2; i++) { if (s->failed_num[i] != sh->pd_idx && s->failed_num[i] != sh->qd_idx && !test_bit(R5_UPTODATE, &fdev[i]->flags) &&