![]() When iterating through an array, one must be careful to test one's index variable rather than another similarly-named variable. The loop will read off the end of conf->disks[] in the following (pathological) case: % dd bs=1 seek=840716287 if=/dev/zero of=d1 count=1 % for i in 2 3 4; do dd if=/dev/zero of=d$i bs=1k count=$(($i+150)); done % ./vmlinux ubd0=root ubd1=d1 ubd2=d2 ubd3=d3 ubd4=d4 # mdadm -C /dev/md0 --level=linear --raid-devices=4 /dev/ubd[1234] adding some printks, I saw this: [42949374.960000] hash_spacing = 821120 [42949374.960000] cnt = 4 [42949374.960000] min_spacing = 801 [42949374.960000] j=0 size=820928 sz=820928 [42949374.960000] i=0 sz=820928 hash_spacing=820928 [42949374.960000] j=1 size=64 sz=64 [42949374.960000] j=2 size=64 sz=128 [42949374.960000] j=3 size=64 sz=192 [42949374.960000] j=4 size=1515870810 sz=1515871002 Cc: Gautham R Shenoy <ego@in.ibm.com> Acked-by: Neil Brown <neilb@cse.unsw.edu.au> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
---|---|---|
.. | ||
raid6test | ||
.gitignore | ||
bitmap.c | ||
dm-bio-list.h | ||
dm-bio-record.h | ||
dm-crypt.c | ||
dm-emc.c | ||
dm-exception-store.c | ||
dm-hw-handler.c | ||
dm-hw-handler.h | ||
dm-io.c | ||
dm-io.h | ||
dm-ioctl.c | ||
dm-linear.c | ||
dm-log.c | ||
dm-log.h | ||
dm-mpath.c | ||
dm-mpath.h | ||
dm-path-selector.c | ||
dm-path-selector.h | ||
dm-raid1.c | ||
dm-round-robin.c | ||
dm-snap.c | ||
dm-snap.h | ||
dm-stripe.c | ||
dm-table.c | ||
dm-target.c | ||
dm-zero.c | ||
dm.c | ||
dm.h | ||
faulty.c | ||
Kconfig | ||
kcopyd.c | ||
kcopyd.h | ||
linear.c | ||
Makefile | ||
md.c | ||
mktables.c | ||
multipath.c | ||
raid0.c | ||
raid1.c | ||
raid5.c | ||
raid6.h | ||
raid6algos.c | ||
raid6altivec.uc | ||
raid6int.uc | ||
raid6mmx.c | ||
raid6recov.c | ||
raid6sse1.c | ||
raid6sse2.c | ||
raid6x86.h | ||
raid10.c | ||
unroll.pl | ||
xor.c |