From: Greg Kroah-Hartman Date: Tue, 30 Jun 2009 19:09:15 +0000 (-0700) Subject: .27 patches X-Git-Tag: v2.6.27.26~11 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6909e38059ac27add5ea7d4f4eec0c5c2af150c8;p=thirdparty%2Fkernel%2Fstable-queue.git .27 patches --- diff --git a/queue-2.6.27/dm-mpath-validate-hw_handler-argument-count.patch b/queue-2.6.27/dm-mpath-validate-hw_handler-argument-count.patch new file mode 100644 index 00000000000..cf44eafd465 --- /dev/null +++ b/queue-2.6.27/dm-mpath-validate-hw_handler-argument-count.patch @@ -0,0 +1,33 @@ +From e094f4f15f5169526c7200b9bde44b900548a81e Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Mon, 22 Jun 2009 10:12:10 +0100 +Subject: dm mpath: validate hw_handler argument count + +From: Mikulas Patocka + +commit e094f4f15f5169526c7200b9bde44b900548a81e upstream. + +Fix arg count parsing error in hw handlers. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-mpath.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -684,6 +684,11 @@ static int parse_hw_handler(struct arg_s + if (!hw_argc) + return 0; + ++ if (hw_argc > as->argc) { ++ ti->error = "not enough arguments for hardware handler"; ++ return -EINVAL; ++ } ++ + m->hw_handler_name = kstrdup(shift(as), GFP_KERNEL); + request_module("scsi_dh_%s", m->hw_handler_name); + if (scsi_dh_handler_exist(m->hw_handler_name) == 0) { diff --git a/queue-2.6.27/dm-mpath-validate-table-argument-count.patch b/queue-2.6.27/dm-mpath-validate-table-argument-count.patch new file mode 100644 index 00000000000..05a80a45523 --- /dev/null +++ b/queue-2.6.27/dm-mpath-validate-table-argument-count.patch @@ -0,0 +1,40 @@ +From 0e0497c0c017664994819f4602dc07fd95896c52 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Mon, 22 Jun 2009 10:08:02 +0100 +Subject: dm mpath: validate table argument count + +From: Mikulas Patocka + +commit 0e0497c0c017664994819f4602dc07fd95896c52 upstream. + +The parser reads the argument count as a number but doesn't check that +sufficient arguments are supplied. This command triggers the bug: + +dmsetup create mpath --table "0 `blockdev --getsize /dev/mapper/cr0` + multipath 0 0 2 1 round-robin 1000 0 1 1 /dev/mapper/cr0 + round-robin 0 1 1 /dev/mapper/cr1 1000" +kernel BUG at drivers/md/dm-mpath.c:530! + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-mpath.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -540,6 +540,12 @@ static int parse_path_selector(struct ar + return -EINVAL; + } + ++ if (ps_argc > as->argc) { ++ dm_put_path_selector(pst); ++ ti->error = "not enough arguments for path selector"; ++ return -EINVAL; ++ } ++ + r = pst->create(&pg->ps, ps_argc, as->argv); + if (r) { + dm_put_path_selector(pst); diff --git a/queue-2.6.27/dm-sysfs-skip-output-when-device-is-being-destroyed.patch b/queue-2.6.27/dm-sysfs-skip-output-when-device-is-being-destroyed.patch new file mode 100644 index 00000000000..1bc97844d9a --- /dev/null +++ b/queue-2.6.27/dm-sysfs-skip-output-when-device-is-being-destroyed.patch @@ -0,0 +1,36 @@ +From 4d89b7b4e4726893453d0fb4ddbb5b3e16353994 Mon Sep 17 00:00:00 2001 +From: Milan Broz +Date: Mon, 22 Jun 2009 10:12:11 +0100 +Subject: dm: sysfs skip output when device is being destroyed + +From: Milan Broz + +commit 4d89b7b4e4726893453d0fb4ddbb5b3e16353994 upstream. + +Do not process sysfs attributes when device is being destroyed. + +Otherwise code can cause + BUG_ON(test_bit(DMF_FREEING, &md->flags)); +in dm_put() call. + +Signed-off-by: Milan Broz +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -265,6 +265,10 @@ static int dm_blk_open(struct inode *ino + goto out; + } + ++ if (test_bit(DMF_FREEING, &md->flags) || ++ test_bit(DMF_DELETING, &md->flags)) ++ return NULL; ++ + dm_get(md); + atomic_inc(&md->open_count); + diff --git a/queue-2.6.27/series b/queue-2.6.27/series index 2e9fd557c9a..58f78269297 100644 --- a/queue-2.6.27/series +++ b/queue-2.6.27/series @@ -26,3 +26,6 @@ pci-pm-follow-pci_pm_ctrl_no_soft_reset-during-transitions-from-d3.patch pcmcia-cm4000-fix-lock-imbalance.patch sound-seq_midi_event-fix-decoding-of-rpn-events.patch mm-fix-handling-of-pagesets-for-downed-cpus.patch +dm-mpath-validate-hw_handler-argument-count.patch +dm-mpath-validate-table-argument-count.patch +dm-sysfs-skip-output-when-device-is-being-destroyed.patch