github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-10 15:42:19 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
f4e2229ea5
linux/drivers/md
History
NeilBrown e301f7b1db md/raid1: fix use-after-free bug in RAID1 data-check code. 
commit 2d4f4f3384 upstream.

This bug has been present ever since data-check was introduce
in 2.6.16.  However it would only fire if a data-check were
done on a degraded array, which was only possible if the array
has 3 or more devices.  This is certainly possible, but is quite
uncommon.

Since hot-replace was added in 3.3 it can happen more often as
the same condition can arise if not all possible replacements are
present.

The problem is that as soon as we submit the last read request, the
'r1_bio' structure could be freed at any time, so we really should
stop looking at it.  If the last device is being read from we will
stop looking at it.  However if the last device is not due to be read
from, we will still check the bio pointer in the r1_bio, but the
r1_bio might already be free.

So use the read_targets counter to make sure we stop looking for bios
to submit as soon as we have submitted them all.

This fix is suitable for any -stable kernel since 2.6.16.

Reported-by: Arnold Schulz <arnysch@gmx.net>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-07-19 08:58:55 -07:00
..
persistent-data dm persistent data: fix allocation failure in space map checker init 2012-07-16 09:04:26 -07:00
bitmap.c md/bitmap: fix calculation of 'chunks' - missing shift. 2012-05-04 17:03:18 +10:00
bitmap.h md/bitmap: fix calculation of 'chunks' - missing shift. 2012-05-04 17:03:18 +10:00
dm-bio-record.h
dm-bufio.c dm bufio: prefetch 2012-03-28 18:41:29 +01:00
dm-bufio.h dm bufio: prefetch 2012-03-28 18:41:29 +01:00
dm-crypt.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-delay.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-exception-store.c dm exception store: fix init error path 2012-03-28 18:41:22 +01:00
dm-exception-store.h dm snapshot: test chunk size against both origin and snapshot 2010-08-12 04:13:51 +01:00
dm-flakey.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-io.c dm io: fix discard support 2012-03-07 19:09:37 +00:00
dm-ioctl.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-kcopyd.c dm kcopyd: add dm_kcopyd_zero to zero an area 2011-10-31 20:18:58 +00:00
dm-linear.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-log-userspace-base.c Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux 2011-11-06 19:44:47 -08:00
dm-log-userspace-transfer.c connector/userns: replace netlink uses of cap_raised() with capable() 2012-05-10 23:21:39 -04:00
dm-log-userspace-transfer.h dm log: userspace add luid to distinguish between concurrent log instances 2009-09-04 20:40:34 +01:00
dm-log.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-mpath.c dm mpath: check if scsi_dh module already loaded before trying to load 2012-05-12 01:43:21 +01:00
dm-mpath.h
dm-path-selector.c md: Add module.h to all files using it implicitly 2011-10-31 19:31:18 -04:00
dm-path-selector.h
dm-queue-length.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-raid.c DM RAID: Use safe version of rdev_for_each 2012-04-24 10:23:13 +10:00
dm-raid1.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-region-hash.c Fix common misspellings 2011-03-31 11:26:23 -03:00
dm-round-robin.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-service-time.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-snap-persistent.c md: Add in export.h for files using EXPORT_SYMBOL 2011-10-31 19:31:19 -04:00
dm-snap-transient.c md: Add in export.h for files using EXPORT_SYMBOL 2011-10-31 19:31:19 -04:00
dm-snap.c dm snapshot: skip reading origin when overwriting complete chunk 2011-08-02 12:32:04 +01:00
dm-stripe.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-sysfs.c Driver core: Constify struct sysfs_ops in struct kobj_type 2010-03-07 17:04:49 -08:00
dm-table.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-target.c dm: error return error for discards 2010-08-12 04:14:14 +01:00
dm-thin-metadata.c dm thin: relax hard limit on the maximum size of a metadata device 2012-03-28 18:41:28 +01:00
dm-thin-metadata.h dm thin: relax hard limit on the maximum size of a metadata device 2012-03-28 18:41:28 +01:00
dm-thin.c dm thin: fix table output when pool target disables discard passdown internally 2012-05-19 01:01:01 +01:00
dm-uevent.c md: Add in export.h for files using EXPORT_SYMBOL 2011-10-31 19:31:19 -04:00
dm-uevent.h
dm-verity.c dm: add verity target 2012-03-28 18:43:38 +01:00
dm-zero.c dm: zero silently drop discards 2010-08-12 04:14:12 +01:00
dm.c dm: clear bi_end_io on remapping failure 2012-03-28 18:41:25 +01:00
dm.h dm table: add immutable feature 2011-10-31 20:19:04 +00:00
faulty.c md: tidy up rdev_for_each usage. 2012-03-19 12:46:39 +11:00
Kconfig dm: add verity target 2012-03-28 18:43:38 +01:00
linear.c md/linear: If md_integrity_register() fails, linear_run() must free the mem. 2012-04-02 09:48:37 +10:00
linear.h md/linear: typedef removal: linear_conf_t -> struct linear_conf 2011-10-11 16:48:54 +11:00
Makefile dm: add verity target 2012-03-28 18:43:38 +01:00
md.c md: using GFP_NOIO to allocate bio for flush request 2012-06-01 15:18:19 +08:00
md.h md/raid10: handle merge_bvec_fn in member devices. 2012-03-19 12:46:39 +11:00
multipath.c md: tidy up rdev_for_each usage. 2012-03-19 12:46:39 +11:00
multipath.h md/multipath: typedef removal: multipath_conf_t -> struct mpconf 2011-10-11 16:48:57 +11:00
raid1.c md/raid1: fix use-after-free bug in RAID1 data-check code. 2012-07-19 08:58:55 -07:00
raid1.h md/raid1: Allocate spare to store replacement devices and their bios. 2011-12-23 10:17:56 +11:00
raid5.c md/raid5: Do not add data_offset before call to is_badblock 2012-07-16 09:04:43 -07:00
raid5.h md/raid5: detect and handle replacements during recovery. 2011-12-23 10:17:53 +11:00
raid10.c md/raid10: fix failure when trying to repair a read error. 2012-07-16 09:04:25 -07:00
raid10.h md/raid10: prepare data structures for handling replacement. 2011-12-23 10:17:54 +11:00
raid0.c md: Avoid OOPS when reshaping raid1 to raid0 2012-04-03 15:37:26 +10:00
raid0.h md: add proper merge_bvec handling to RAID0 and Linear. 2012-03-19 12:46:39 +11:00