.29 patches

diff --git a/queue-2.6.29/dm-mpath-validate-hw_handler-argument-count.patch b/queue-2.6.29/dm-mpath-validate-hw_handler-argument-count.patch
new file mode 100644 (file)
index 0000000..8ce6888
--- /dev/null
+++ b/queue-2.6.29/dm-mpath-validate-hw_handler-argument-count.patch
@@ -0,0 +1,33 @@
+From e094f4f15f5169526c7200b9bde44b900548a81e Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 22 Jun 2009 10:12:10 +0100
+Subject: dm mpath: validate hw_handler argument count
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit e094f4f15f5169526c7200b9bde44b900548a81e upstream.
+
+Fix arg count parsing error in hw handlers.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -706,6 +706,11 @@ static int parse_hw_handler(struct arg_s
+       if (!hw_argc)
+               return 0;
+ 
++      if (hw_argc > as->argc) {
++              ti->error = "not enough arguments for hardware handler";
++              return -EINVAL;
++      }
++
+       m->hw_handler_name = kstrdup(shift(as), GFP_KERNEL);
+       request_module("scsi_dh_%s", m->hw_handler_name);
+       if (scsi_dh_handler_exist(m->hw_handler_name) == 0) {

diff --git a/queue-2.6.29/dm-mpath-validate-table-argument-count.patch b/queue-2.6.29/dm-mpath-validate-table-argument-count.patch
new file mode 100644 (file)
index 0000000..666af52
--- /dev/null
+++ b/queue-2.6.29/dm-mpath-validate-table-argument-count.patch
@@ -0,0 +1,40 @@
+From 0e0497c0c017664994819f4602dc07fd95896c52 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 22 Jun 2009 10:08:02 +0100
+Subject: dm mpath: validate table argument count
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 0e0497c0c017664994819f4602dc07fd95896c52 upstream.
+
+The parser reads the argument count as a number but doesn't check that
+sufficient arguments are supplied. This command triggers the bug:
+
+dmsetup create mpath --table "0 `blockdev --getsize /dev/mapper/cr0`
+    multipath 0 0 2 1 round-robin 1000 0 1 1 /dev/mapper/cr0
+    round-robin 0 1 1 /dev/mapper/cr1 1000"
+kernel BUG at drivers/md/dm-mpath.c:530!
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -554,6 +554,12 @@ static int parse_path_selector(struct ar
+               return -EINVAL;
+       }
+ 
++      if (ps_argc > as->argc) {
++              dm_put_path_selector(pst);
++              ti->error = "not enough arguments for path selector";
++              return -EINVAL;
++      }
++
+       r = pst->create(&pg->ps, ps_argc, as->argv);
+       if (r) {
+               dm_put_path_selector(pst);

diff --git a/queue-2.6.29/series b/queue-2.6.29/series
index c1b520114176ca202ee6affb1cd8b7e3f719745b..9a7bcc5e6fdb3bf0a20221f08f1489ad96d822cb 100644 (file)
--- a/queue-2.6.29/series
+++ b/queue-2.6.29/series
@@ -32,3 +32,5 @@ pcmcia-cm4000-fix-lock-imbalance.patch
 qla2xxx-correct-overflow-during-dump-processing-on-large-memory-isp23xx-parts.patch
 sound-seq_midi_event-fix-decoding-of-rpn-events.patch
 mm-fix-handling-of-pagesets-for-downed-cpus.patch
+dm-mpath-validate-table-argument-count.patch
+dm-mpath-validate-hw_handler-argument-count.patch