John Pittman a268d985f0 md/raid10: prevent access of uninitialized resync_pages offset ... commit 45422b704d upstream. Due to unneeded multiplication in the out_free_pages portion of r10buf_pool_alloc(), when using a 3-copy raid10 layout, it is possible to access a resync_pages offset that has not been initialized. This access translates into a crash of the system within resync_free_pages() while passing a bad pointer to put_page(). Remove the multiplication, preventing access to the uninitialized area. Fixes: f025061836 ("md: raid10: don't use bio's vec table to manage resync pages") Cc: stable@vger.kernel.org # 4.12+ Signed-off-by: John Pittman <jpittman@redhat.com> Suggested-by: David Jeffery <djeffery@redhat.com> Reviewed-by: Laurence Oberman <loberman@redhat.com> Signed-off-by: Song Liu <songliubraving@fb.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-12-01 09:17:36 +01:00
..
bcache	bcache: recal cached_dev_sectors on detach	2019-11-24 08:20:38 +01:00
persistent-data	dm space map metadata: fix missing store of apply_bops() return value	2019-08-29 08:28:56 +02:00
dm-bio-prison-v1.c
dm-bio-prison-v1.h
dm-bio-prison-v2.c
dm-bio-prison-v2.h
dm-bio-record.h
dm-bufio.c	Revert "dm bufio: fix deadlock with loop device"	2019-08-29 08:28:49 +02:00
dm-builtin.c
dm-cache-background-tracker.c
dm-cache-background-tracker.h
dm-cache-block-types.h
dm-cache-metadata.c
dm-cache-metadata.h
dm-cache-policy-internal.h
dm-cache-policy-smq.c
dm-cache-policy.c
dm-cache-policy.h
dm-cache-target.c	dm cache: fix bugs when a GFP_NOWAIT allocation fails	2019-10-29 09:20:03 +01:00
dm-core.h	dm: disable DISCARD if the underlying storage no longer supports it	2019-08-25 10:48:01 +02:00
dm-crypt.c	dm crypt: move detailed message into debug level	2019-09-16 08:22:14 +02:00
dm-delay.c
dm-era-target.c
dm-exception-store.c
dm-exception-store.h
dm-flakey.c
dm-integrity.c	dm integrity: fix a crash due to BUG_ON in __journal_read_write()	2019-08-29 08:28:55 +02:00
dm-io.c
dm-ioctl.c
dm-kcopyd.c	dm kcopyd: always complete failed jobs	2019-08-29 08:28:55 +02:00
dm-linear.c
dm-log-userspace-base.c
dm-log-userspace-transfer.c
dm-log-userspace-transfer.h
dm-log-writes.c	dm log writes: make sure super sector log updates are written in order	2019-07-03 13:14:45 +02:00
dm-log.c
dm-mpath.c	dm mpath: fix missing call of path selector type->end_io	2019-09-16 08:22:12 +02:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h
dm-queue-length.c
dm-raid.c	dm raid: avoid bitmap with raid4/5/6 journal device	2019-12-01 09:16:39 +01:00
dm-raid1.c
dm-region-hash.c
dm-round-robin.c
dm-rq.c	blk-mq: add callback of .cleanup_rq	2019-10-05 13:10:03 +02:00
dm-rq.h
dm-service-time.c
dm-snap-persistent.c
dm-snap-transient.c
dm-snap.c	dm snapshot: rework COW throttling to fix deadlock	2019-11-06 13:05:11 +01:00
dm-stats.c
dm-stats.h
dm-stripe.c
dm-switch.c
dm-sysfs.c
dm-table.c	dm table: fix invalid memory accesses with too high sector number	2019-08-29 08:28:56 +02:00
dm-target.c	dm mpath: fix missing call of path selector type->end_io	2019-09-16 08:22:12 +02:00
dm-thin-metadata.c	dm thin metadata: check if in fail_io mode when setting needs_check	2019-09-16 08:22:21 +02:00
dm-thin-metadata.h
dm-thin.c
dm-uevent.c
dm-uevent.h
dm-unstripe.c
dm-verity-fec.c
dm-verity-fec.h
dm-verity-target.c	dm verity: use message limit for data block corruption message	2019-07-21 09:03:08 +02:00
dm-verity.h
dm-writecache.c
dm-zero.c
dm-zoned-metadata.c	dm zoned: fix potential NULL dereference in dmz_do_reclaim()	2019-08-29 08:28:59 +02:00
dm-zoned-reclaim.c	dm zoned: properly handle backing device failure	2019-08-29 08:28:56 +02:00
dm-zoned-target.c	dm zoned: fix invalid memory access	2019-10-01 08:26:10 +02:00
dm-zoned.h	dm zoned: properly handle backing device failure	2019-08-29 08:28:56 +02:00
dm.c	dm: disable DISCARD if the underlying storage no longer supports it	2019-08-25 10:48:01 +02:00
dm.h
Kconfig
Makefile
md-bitmap.c
md-bitmap.h
md-cluster.c
md-cluster.h
md-faulty.c
md-linear.c
md-linear.h
md-multipath.c
md-multipath.h
md.c	md: allow metadata updates while suspending an array - fix	2019-11-24 08:19:58 +01:00
md.h	md: don't report active array_state until after revalidate_disk() completes.	2019-10-05 13:10:10 +02:00
raid1-10.c
raid1.c	md/raid1: fail run raid1 array when active disk less than one	2019-10-05 13:09:54 +02:00
raid1.h
raid5-cache.c
raid5-log.h
raid5-ppl.c
raid5.c	md/raid6: Set R5_ReadError when there is read failure on parity disk	2019-10-05 13:10:10 +02:00
raid5.h
raid10.c	md/raid10: prevent access of uninitialized resync_pages offset	2019-12-01 09:17:36 +01:00
raid10.h
raid0.c	md/raid0: fix warning message for parameter default_layout	2019-10-29 09:19:37 +01:00
raid0.h	md/raid0: avoid RAID0 data corruption due to layout confusion.	2019-10-05 13:10:12 +02:00