md: Fix a bug in linear.c causing which_dev() to return the wrong device.

ab5bd5cbc8d4b868378d062eed3d4240930fbb86 introduced the following
bug in linear software raid for large arrays on 32 bit machines:

which_dev() computes the device holding a given sector by shifting
down the sector number to a 32 bit range, dividing by the array
spacing and looking up the resulting index in the hash table of
the array.

Because the computed index might be slightly too small, a loop at
the end of which_dev() increases the index until the given sector
actually falls into the range of the device associated with that index.

The changes of the above mentioned commit caused this loop to check
whether the _index_ rather than the sector number is small enough,
effectively bypassing the loop and thus possibly returning the wrong
device.

As reported by Simon Kirby, this leads to errors such as

	linear_make_request: Sector 2340486136 out of bounds on dev sdi: 156301312 sectors, offset 2109870464

Fix this bug by introducing a local variable for the index so that
the variable containing the passed sector is left unchanged.

Cc: stable@kernel.org
Signed-off-by: Andre Noll <maan@systemlinux.org>
Signed-off-by: NeilBrown <neilb@suse.de>

diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 1e3aea9eecf18009f4ff0bc2e4c474914e1bcf74..09658b218474a3a8f676995f02e59fdfa10693b0 100644 (file)
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -25,13 +25,13 @@ static inline dev_info_t *which_dev(mddev_t *mddev, sector_t sector)
 {
        dev_info_t *hash;
        linear_conf_t *conf = mddev_to_conf(mddev);
+       sector_t idx = sector >> conf->sector_shift;
 
        /*
         * sector_div(a,b) returns the remainer and sets a to a/b
         */
-       sector >>= conf->sector_shift;
-       (void)sector_div(sector, conf->spacing);
-       hash = conf->hash_table[sector];
+       (void)sector_div(idx, conf->spacing);
+       hash = conf->hash_table[idx];
 
        while (sector >= hash->num_sectors + hash->start_sector)
                hash++;