public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-10-31 16:54:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/drivers/md
History
Mikulas Patocka e9c6a18264 dm snapshot: fix data corruption 
This patch fixes a particular type of data corruption that has been
encountered when loading a snapshot's metadata from disk.

When we allocate a new chunk in persistent_prepare, we increment
ps->next_free and we make sure that it doesn't point to a metadata area
by further incrementing it if necessary.

When we load metadata from disk on device activation, ps->next_free is
positioned after the last used data chunk. However, if this last used
data chunk is followed by a metadata area, ps->next_free is positioned
erroneously to the metadata area. A newly-allocated chunk is placed at
the same location as the metadata area, resulting in data or metadata
corruption.

This patch changes the code so that ps->next_free skips the metadata
area when metadata are loaded in function read_exceptions.

The patch also moves a piece of code from persistent_prepare_exception
to a separate function skip_metadata to avoid code duplication.

CVE-2013-4299

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Cc: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
2013-10-16 03:17:47 +01:00
..
bcache bcache: Fix a null ptr deref regression 2013-10-10 18:17:39 -07:00
persistent-data dm space map: optimise sm_ll_dec and sm_ll_inc 2013-08-23 09:02:14 -04:00
bitmap.c md: replace strict_strto*() with kstrto*() 2013-06-14 08:10:26 +10:00
bitmap.h md/bitmap: record the space available for the bitmap in the superblock. 2012-05-22 13:55:34 +10:00
dm-bio-prison.c dm: add cache target 2013-03-01 22:45:51 +00:00
dm-bio-prison.h dm: add cache target 2013-03-01 22:45:51 +00:00
dm-bio-record.h
dm-bufio.c drivers: convert shrinkers to new count/scan API 2013-09-10 18:56:32 -04:00
dm-bufio.h dm bufio: prefetch 2012-03-28 18:41:29 +01:00
dm-cache-block-types.h dm: add cache target 2013-03-01 22:45:51 +00:00
dm-cache-metadata.c dm cache: replace memcpy with struct assignment 2013-05-10 14:37:18 +01:00
dm-cache-metadata.h dm cache: policy ignore hints if generated by different version 2013-03-20 17:21:28 +00:00
dm-cache-policy-cleaner.c dm cache: policy change version from string to integer set 2013-03-20 17:21:27 +00:00
dm-cache-policy-internal.h dm cache: policy change version from string to integer set 2013-03-20 17:21:27 +00:00
dm-cache-policy-mq.c dm cache: avoid conflicting remove_mapping() in mq policy 2013-08-16 15:56:51 -04:00
dm-cache-policy.c dm cache: policy change version from string to integer set 2013-03-20 17:21:27 +00:00
dm-cache-policy.h dm cache policy: fix description of lookup fn 2013-05-10 14:37:17 +01:00
dm-cache-target.c dm cache: eliminate holes in cache structure 2013-08-23 09:02:14 -04:00
dm-crypt.c dm: stop using WQ_NON_REENTRANT 2013-08-23 09:02:13 -04:00
dm-delay.c dm: rename request variables to bios 2013-03-01 22:45:47 +00:00
dm-exception-store.c dm: replace simple_strtoul 2012-07-27 15:07:59 +01:00
dm-exception-store.h
dm-flakey.c dm flakey: correct ctr alloc failure mesg 2013-07-10 23:41:17 +01:00
dm-io.c dm: add reserved_bio_based_ios module parameter 2013-09-23 10:42:24 -04:00
dm-ioctl.c dm: add statistics support 2013-09-05 20:46:06 -04:00
dm-kcopyd.c dm: stop using WQ_NON_REENTRANT 2013-08-23 09:02:13 -04:00
dm-linear.c dm: rename request variables to bios 2013-03-01 22:45:47 +00:00
dm-log-userspace-base.c
dm-log-userspace-transfer.c connector/userns: replace netlink uses of cap_raised() with capable() 2012-05-10 23:21:39 -04:00
dm-log-userspace-transfer.h
dm-log.c dm: use memweight() 2012-07-30 17:25:16 -07:00
dm-mpath.c dm: add reserved_rq_based_ios module parameter 2013-09-23 10:42:24 -04:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h
dm-queue-length.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-raid.c MD: Remember the last sync operation that was performed 2013-06-26 12:38:24 +10:00
dm-raid1.c dm: stop using WQ_NON_REENTRANT 2013-08-23 09:02:13 -04:00
dm-region-hash.c dm raid1: fix crash with mirror recovery and discard 2012-07-20 14:25:03 +01:00
dm-round-robin.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-service-time.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-snap-persistent.c dm snapshot: fix data corruption 2013-10-16 03:17:47 +01:00
dm-snap-transient.c
dm-snap.c dm-snapshot: fix performance degradation due to small hash size 2013-09-20 10:36:34 -04:00
dm-stats.c dm stats: fix possible counter corruption on 32-bit systems 2013-09-18 14:41:06 -04:00
dm-stats.h dm: add statistics support 2013-09-05 20:46:06 -04:00
dm-stripe.c dm stripe: silence a couple sparse warnings 2013-09-06 11:36:01 -04:00
dm-switch.c dm: add switch target 2013-07-10 23:41:19 +01:00
dm-sysfs.c
dm-table.c dm ioctl: increase granularity of type_lock when loading table 2013-09-05 20:46:06 -04:00
dm-target.c dm: allow error target to replace bio-based and request-based targets 2013-09-05 20:46:05 -04:00
dm-thin-metadata.c dm thin: generate event when metadata threshold passed 2013-05-10 14:37:21 +01:00
dm-thin-metadata.h dm thin: generate event when metadata threshold passed 2013-05-10 14:37:21 +01:00
dm-thin.c dm thin: do not expose non-zero discard limits if discards disabled 2013-09-23 10:42:06 -04:00
dm-uevent.c
dm-uevent.h
dm-verity.c dm verity: use __ffs and __fls 2013-07-10 23:41:17 +01:00
dm-zero.c dm: rename request variables to bios 2013-03-01 22:45:47 +00:00
dm.c dm: add reserved_bio_based_ios module parameter 2013-09-23 10:42:24 -04:00
dm.h dm: add reserved_bio_based_ios module parameter 2013-09-23 10:42:24 -04:00
faulty.c block: Add bio_end_sector() 2013-03-23 14:15:29 -07:00
Kconfig dm: add switch target 2013-07-10 23:41:19 +01:00
linear.c block: Add bio_end_sector() 2013-03-23 14:15:29 -07:00
linear.h
Makefile dm: add statistics support 2013-09-05 20:46:06 -04:00
md.c md: avoid deadlock when dirty buffers during md_stop. 2013-08-27 16:45:00 +10:00
md.h md: avoid deadlock when dirty buffers during md_stop. 2013-08-27 16:45:00 +10:00
multipath.c MD: change the parameter of md thread 2012-10-11 13:34:00 +11:00
multipath.h
raid0.c md: fix buglet in RAID5 -> RAID0 conversion. 2013-06-26 12:38:19 +10:00
raid0.h md: add proper merge_bvec handling to RAID0 and Linear. 2012-03-19 12:46:39 +11:00
raid1.c md/raid1: fix bio handling problems in process_checks() 2013-07-18 14:18:04 +10:00
raid1.h md/raid1: prevent merging too large request 2012-07-31 10:03:53 +10:00
raid5.c raid5: only wakeup necessary threads 2013-09-02 10:31:29 +10:00
raid5.h raid5: only wakeup necessary threads 2013-09-02 10:31:29 +10:00
raid10.c md/raid10: remove use-after-free bug. 2013-07-25 16:46:53 +10:00
raid10.h MD RAID10: Improve redundancy for 'far' and 'offset' algorithms (part 1) 2013-02-26 11:55:30 +11:00