From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Tue, 30 Jun 2009 18:28:52 +0000 (-0700)
Subject: .29 patches
X-Git-Tag: v2.6.27.26~14
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a4e6e911311b66e0bd16df8a2bdbd471504e357e;p=thirdparty%2Fkernel%2Fstable-queue.git

.29 patches
---

diff --git a/queue-2.6.29/dm-mpath-validate-hw_handler-argument-count.patch b/queue-2.6.29/dm-mpath-validate-hw_handler-argument-count.patch
new file mode 100644
index 00000000000..8ce688892e6
--- /dev/null
+++ b/queue-2.6.29/dm-mpath-validate-hw_handler-argument-count.patch
@@ -0,0 +1,33 @@
+From e094f4f15f5169526c7200b9bde44b900548a81e Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 22 Jun 2009 10:12:10 +0100
+Subject: dm mpath: validate hw_handler argument count
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit e094f4f15f5169526c7200b9bde44b900548a81e upstream.
+
+Fix arg count parsing error in hw handlers.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -706,6 +706,11 @@ static int parse_hw_handler(struct arg_s
+ 	if (!hw_argc)
+ 		return 0;
+ 
++	if (hw_argc > as->argc) {
++		ti->error = "not enough arguments for hardware handler";
++		return -EINVAL;
++	}
++
+ 	m->hw_handler_name = kstrdup(shift(as), GFP_KERNEL);
+ 	request_module("scsi_dh_%s", m->hw_handler_name);
+ 	if (scsi_dh_handler_exist(m->hw_handler_name) == 0) {
diff --git a/queue-2.6.29/dm-mpath-validate-table-argument-count.patch b/queue-2.6.29/dm-mpath-validate-table-argument-count.patch
new file mode 100644
index 00000000000..666af5256f2
--- /dev/null
+++ b/queue-2.6.29/dm-mpath-validate-table-argument-count.patch
@@ -0,0 +1,40 @@
+From 0e0497c0c017664994819f4602dc07fd95896c52 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 22 Jun 2009 10:08:02 +0100
+Subject: dm mpath: validate table argument count
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 0e0497c0c017664994819f4602dc07fd95896c52 upstream.
+
+The parser reads the argument count as a number but doesn't check that
+sufficient arguments are supplied. This command triggers the bug:
+
+dmsetup create mpath --table "0 `blockdev --getsize /dev/mapper/cr0`
+    multipath 0 0 2 1 round-robin 1000 0 1 1 /dev/mapper/cr0
+    round-robin 0 1 1 /dev/mapper/cr1 1000"
+kernel BUG at drivers/md/dm-mpath.c:530!
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -554,6 +554,12 @@ static int parse_path_selector(struct ar
+ 		return -EINVAL;
+ 	}
+ 
++	if (ps_argc > as->argc) {
++		dm_put_path_selector(pst);
++		ti->error = "not enough arguments for path selector";
++		return -EINVAL;
++	}
++
+ 	r = pst->create(&pg->ps, ps_argc, as->argv);
+ 	if (r) {
+ 		dm_put_path_selector(pst);
diff --git a/queue-2.6.29/series b/queue-2.6.29/series
index c1b52011417..9a7bcc5e6fd 100644
--- a/queue-2.6.29/series
+++ b/queue-2.6.29/series
@@ -32,3 +32,5 @@ pcmcia-cm4000-fix-lock-imbalance.patch
 qla2xxx-correct-overflow-during-dump-processing-on-large-memory-isp23xx-parts.patch
 sound-seq_midi_event-fix-decoding-of-rpn-events.patch
 mm-fix-handling-of-pagesets-for-downed-cpus.patch
+dm-mpath-validate-table-argument-count.patch
+dm-mpath-validate-hw_handler-argument-count.patch