Commit d07bd3bc authored Jul 21, 2008 by Andre Noll Committed by NeilBrown Jul 21, 2008

md: Fix check for overlapping devices.

The checks in overlaps() expect all parameters either in block-based
or sector-based quantities. However, its single caller passes two
rdev->data_offset arguments as well as two rdev->size arguments, the
former being sector counts while the latter are measured in 1K blocks.

This could cause rdev_size_store() to accept an invalid size from user
space. Fix it by passing only sector-based quantities to overlaps().

Signed-off-by: Andre Noll <maan@systemlinux.org>
Signed-off-by: NeilBrown <neilb@suse.de>

parent d7027458

drivers/md/md.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -2143,8 +2143,9 @@ rdev_size_store(mdk_rdev_t rdev, const char buf, size_t len)
		if (test_bit(AllReserved, &rdev2->flags) \|\|
		(rdev->bdev == rdev2->bdev &&
		rdev != rdev2 &&
		overlaps(rdev->data_offset, rdev->size,
		rdev2->data_offset, rdev2->size))) {
		overlaps(rdev->data_offset, rdev->size * 2,
		rdev2->data_offset,
		rdev2->size * 2))) {
		overlap = 1;
		break;
		}