linux-kernel - PULL REQUEST - serious md/RAID10 bug in 3.1 when activating a hot-spare.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Mon, 31 Oct 2011 13:08:59 +1100
From:	NeilBrown <neilb@...e.de>
To:	Linus Torvalds <torvalds@...ux-foundation.org>,
	linux RAID <linux-raid@...r.kernel.org>,
	lkml <linux-kernel@...r.kernel.org>
Subject: PULL REQUEST - serious md/RAID10 bug in 3.1 when activating a
 hot-spare.


Hi Linus et al,

 I just discovered a fairly serious flaw that I introduced into 3.1 - details
 below.

 Anyone running RAID10 with 3.1 is advised to either apply this patch or
 revert an earlier kernel as soon as possible.  In the mean time, remove any
 hot spares from an RAID10 array.

NeilBrown


The following changes since commit d890fa2b0586b6177b119643ff66932127d58afa:

  md: Fix some bugs in recovery_disabled handling. (2011-10-26 11:54:39 +1100)

are available in the git repository at:
  git://neil.brown.name/md for-linus

  last commit being 7fcc7c8acf0fba44d19a713207af7e58267c1179

NeilBrown (1):
      md/raid10:  Fix bug when activating a hot-spare.

 drivers/md/raid10.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)



commit 7fcc7c8acf0fba44d19a713207af7e58267c1179
Author: NeilBrown <neilb@...e.de>
Date:   Mon Oct 31 12:59:44 2011 +1100

    md/raid10:  Fix bug when activating a hot-spare.
    
    This is a fairly serious bug in RAID10.
    
    When a RAID10 array is degraded and a hot-spare is activated, the
    spare does not take up the empty slot, but rather replaces the first
    working device.
    This is likely to make the array non-functional.   It would normally
    be possible to recover the data, but that would need care and is not
    guaranteed.
    
    This bug was introduced in commit
       2bb77736ae5dca0a189829fbb7379d43364a9dac
    which first appeared in 3.1.
    
    Cc: stable@...nel.org
    Signed-off-by: NeilBrown <neilb@...e.de>

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 132c18e..c025a82 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1355,7 +1355,7 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
 		struct mirror_info *p = &conf->mirrors[mirror];
 		if (p->recovery_disabled == mddev->recovery_disabled)
 			continue;
-		if (!p->rdev)
+		if (p->rdev)
 			continue;
 
 		disk_stack_limits(mddev->gendisk, rdev->bdev,

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)