md: Fix check for overlapping devices.
authorAndre Noll <maan@systemlinux.org>
Mon, 21 Jul 2008 04:42:07 +0000 (14:42 +1000)
committerNeilBrown <neilb@suse.de>
Mon, 21 Jul 2008 04:42:07 +0000 (14:42 +1000)
The checks in overlaps() expect all parameters either in block-based
or sector-based quantities. However, its single caller passes two
rdev->data_offset arguments as well as two rdev->size arguments, the
former being sector counts while the latter are measured in 1K blocks.

This could cause rdev_size_store() to accept an invalid size from user
space. Fix it by passing only sector-based quantities to overlaps().

Signed-off-by: Andre Noll <maan@systemlinux.org>
Signed-off-by: NeilBrown <neilb@suse.de>
drivers/md/md.c

index 95466bb089ab352ce5c4538431bad3488567b1ff..a2813fa06b7cbb91f4f696e31f9e090ac107cead 100644 (file)
@@ -2143,8 +2143,9 @@ rdev_size_store(mdk_rdev_t *rdev, const char *buf, size_t len)
                                if (test_bit(AllReserved, &rdev2->flags) ||
                                    (rdev->bdev == rdev2->bdev &&
                                     rdev != rdev2 &&
-                                    overlaps(rdev->data_offset, rdev->size,
-                                           rdev2->data_offset, rdev2->size))) {
+                                    overlaps(rdev->data_offset, rdev->size * 2,
+                                             rdev2->data_offset,
+                                             rdev2->size * 2))) {
                                        overlap = 1;
                                        break;
                                }