.27 patches

diff --git a/queue-2.6.27/dm-mpath-validate-hw_handler-argument-count.patch b/queue-2.6.27/dm-mpath-validate-hw_handler-argument-count.patch
new file mode 100644 (file)
index 0000000..cf44eaf
--- /dev/null
+++ b/queue-2.6.27/dm-mpath-validate-hw_handler-argument-count.patch
@@ -0,0 +1,33 @@
+From e094f4f15f5169526c7200b9bde44b900548a81e Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 22 Jun 2009 10:12:10 +0100
+Subject: dm mpath: validate hw_handler argument count
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit e094f4f15f5169526c7200b9bde44b900548a81e upstream.
+
+Fix arg count parsing error in hw handlers.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -684,6 +684,11 @@ static int parse_hw_handler(struct arg_s
+       if (!hw_argc)
+               return 0;
+ 
++      if (hw_argc > as->argc) {
++              ti->error = "not enough arguments for hardware handler";
++              return -EINVAL;
++      }
++
+       m->hw_handler_name = kstrdup(shift(as), GFP_KERNEL);
+       request_module("scsi_dh_%s", m->hw_handler_name);
+       if (scsi_dh_handler_exist(m->hw_handler_name) == 0) {

diff --git a/queue-2.6.27/dm-mpath-validate-table-argument-count.patch b/queue-2.6.27/dm-mpath-validate-table-argument-count.patch
new file mode 100644 (file)
index 0000000..05a80a4
--- /dev/null
+++ b/queue-2.6.27/dm-mpath-validate-table-argument-count.patch
@@ -0,0 +1,40 @@
+From 0e0497c0c017664994819f4602dc07fd95896c52 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 22 Jun 2009 10:08:02 +0100
+Subject: dm mpath: validate table argument count
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 0e0497c0c017664994819f4602dc07fd95896c52 upstream.
+
+The parser reads the argument count as a number but doesn't check that
+sufficient arguments are supplied. This command triggers the bug:
+
+dmsetup create mpath --table "0 `blockdev --getsize /dev/mapper/cr0`
+    multipath 0 0 2 1 round-robin 1000 0 1 1 /dev/mapper/cr0
+    round-robin 0 1 1 /dev/mapper/cr1 1000"
+kernel BUG at drivers/md/dm-mpath.c:530!
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -540,6 +540,12 @@ static int parse_path_selector(struct ar
+               return -EINVAL;
+       }
+ 
++      if (ps_argc > as->argc) {
++              dm_put_path_selector(pst);
++              ti->error = "not enough arguments for path selector";
++              return -EINVAL;
++      }
++
+       r = pst->create(&pg->ps, ps_argc, as->argv);
+       if (r) {
+               dm_put_path_selector(pst);

diff --git a/queue-2.6.27/dm-sysfs-skip-output-when-device-is-being-destroyed.patch b/queue-2.6.27/dm-sysfs-skip-output-when-device-is-being-destroyed.patch
new file mode 100644 (file)
index 0000000..1bc9784
--- /dev/null
+++ b/queue-2.6.27/dm-sysfs-skip-output-when-device-is-being-destroyed.patch
@@ -0,0 +1,36 @@
+From 4d89b7b4e4726893453d0fb4ddbb5b3e16353994 Mon Sep 17 00:00:00 2001
+From: Milan Broz <mbroz@redhat.com>
+Date: Mon, 22 Jun 2009 10:12:11 +0100
+Subject: dm: sysfs skip output when device is being destroyed
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit 4d89b7b4e4726893453d0fb4ddbb5b3e16353994 upstream.
+
+Do not process sysfs attributes when device is being destroyed.
+
+Otherwise code can cause
+  BUG_ON(test_bit(DMF_FREEING, &md->flags));
+in dm_put() call.
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -265,6 +265,10 @@ static int dm_blk_open(struct inode *ino
+               goto out;
+       }
+ 
++      if (test_bit(DMF_FREEING, &md->flags) ||
++          test_bit(DMF_DELETING, &md->flags))
++              return NULL;
++
+       dm_get(md);
+       atomic_inc(&md->open_count);
+ 

diff --git a/queue-2.6.27/series b/queue-2.6.27/series
index 2e9fd557c9ac539d1bd25f0551f93d70464d9e1f..58f7826929765af065e24f0d68ed8a25cea9edb1 100644 (file)
--- a/queue-2.6.27/series
+++ b/queue-2.6.27/series
@@ -26,3 +26,6 @@ pci-pm-follow-pci_pm_ctrl_no_soft_reset-during-transitions-from-d3.patch
 pcmcia-cm4000-fix-lock-imbalance.patch
 sound-seq_midi_event-fix-decoding-of-rpn-events.patch
 mm-fix-handling-of-pagesets-for-downed-cpus.patch
+dm-mpath-validate-hw_handler-argument-count.patch
+dm-mpath-validate-table-argument-count.patch
+dm-sysfs-skip-output-when-device-is-being-destroyed.patch