lkml.org 
[lkml]   [2013]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 101/171 ] pnfs-block: removing DM device maybe cause oops when call dev_remove
    3.6.11.2 stable review patch.
    If anyone has any objections, please let me know.

    ------------------

    From: fanchaoting <fanchaoting@cn.fujitsu.com>

    [ Upstream commit 4376c94618c26225e69e17b7c91169c45a90b292 ]

    when pnfs block using device mapper,if umounting later,it maybe
    cause oops. we apply "1 + sizeof(bl_umount_request)" memory for
    msg->data, the memory maybe overflow when we do "memcpy(&dataptr
    [sizeof(bl_msg)], &bl_umount_request, sizeof(bl_umount_request))",
    because the size of bl_msg is more than 1 byte.

    Signed-off-by: fanchaoting<fanchaoting@cn.fujitsu.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    ---
    fs/nfs/blocklayout/blocklayoutdm.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/fs/nfs/blocklayout/blocklayoutdm.c b/fs/nfs/blocklayout/blocklayoutdm.c
    index 737d839..6fc7b5c 100644
    --- a/fs/nfs/blocklayout/blocklayoutdm.c
    +++ b/fs/nfs/blocklayout/blocklayoutdm.c
    @@ -55,7 +55,8 @@ static void dev_remove(struct net *net, dev_t dev)

    bl_pipe_msg.bl_wq = &nn->bl_wq;
    memset(msg, 0, sizeof(*msg));
    - msg->data = kzalloc(1 + sizeof(bl_umount_request), GFP_NOFS);
    + msg->len = sizeof(bl_msg) + bl_msg.totallen;
    + msg->data = kzalloc(msg->len, GFP_NOFS);
    if (!msg->data)
    goto out;

    @@ -66,7 +67,6 @@ static void dev_remove(struct net *net, dev_t dev)
    memcpy(msg->data, &bl_msg, sizeof(bl_msg));
    dataptr = (uint8_t *) msg->data;
    memcpy(&dataptr[sizeof(bl_msg)], &bl_umount_request, sizeof(bl_umount_request));
    - msg->len = sizeof(bl_msg) + bl_msg.totallen;

    add_wait_queue(&nn->bl_wq, &wq);
    if (rpc_queue_upcall(nn->bl_device_pipe, msg) < 0) {
    --
    1.7.10.4



    \
     
     \ /
      Last update: 2013-04-12 00:21    [W:2.238 / U:0.684 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site