linux/drivers/md
NeilBrown e0ee778528 md/raid10: fix problem with on-stack allocation of r10bio structure.
A 'struct r10bio' has an array of per-copy information at the end.
This array is declared with size [0] and r10bio_pool_alloc allocates
enough extra space to store the per-copy information depending on the
number of copies needed.

So declaring a 'struct r10bio on the stack isn't going to work.  It
won't allocate enough space, and memory corruption will ensue.

So in the two places where this is done, declare a sufficiently large
structure and use that instead.

The two call-sites of this bug were introduced in 3.4 and 3.5
so this is suitable for both those kernels.  The patch will have to
be modified for 3.4 as it only has one bug.

Cc: stable@vger.kernel.org
Reported-by: Ivan Vasilyev <ivan.vasilyev@gmail.com>
Tested-by: Ivan Vasilyev <ivan.vasilyev@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
2012-08-18 09:51:42 +10:00
..
persistent-data dm persistent data: introduce dm_bm_set_read_only 2012-07-27 15:08:15 +01:00
Kconfig Additional md update for 3.6 2012-08-02 11:34:40 -07:00
Makefile
bitmap.c md/raid1: submit IO from originating thread instead of md thread. 2012-08-02 08:33:20 +10:00
bitmap.h
dm-bio-record.h
dm-bufio.c
dm-bufio.h
dm-crypt.c dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
dm-delay.c dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
dm-exception-store.c dm: replace simple_strtoul 2012-07-27 15:07:59 +01:00
dm-exception-store.h
dm-flakey.c dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
dm-io.c
dm-ioctl.c dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
dm-kcopyd.c
dm-linear.c dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
dm-log-userspace-base.c
dm-log-userspace-transfer.c
dm-log-userspace-transfer.h
dm-log.c dm: use memweight() 2012-07-30 17:25:16 -07:00
dm-mpath.c dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h
dm-queue-length.c
dm-raid.c Merge branch 'for-next' of git://neil.brown.name/md 2012-08-01 09:02:01 -07:00
dm-raid1.c dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
dm-region-hash.c dm raid1: fix crash with mirror recovery and discard 2012-07-20 14:25:03 +01:00
dm-round-robin.c
dm-service-time.c
dm-snap-persistent.c
dm-snap-transient.c
dm-snap.c dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
dm-stripe.c dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
dm-sysfs.c
dm-table.c dm: allow targets to request flushes regardless of underlying device support 2012-07-27 15:08:07 +01:00
dm-target.c
dm-thin-metadata.c dm thin metadata: introduce dm_pool_abort_metadata 2012-07-27 15:08:15 +01:00
dm-thin-metadata.h dm thin metadata: introduce dm_pool_abort_metadata 2012-07-27 15:08:15 +01:00
dm-thin.c dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
dm-uevent.c
dm-uevent.h
dm-verity.c dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
dm-zero.c
dm.c dm: introduce split_discard_requests 2012-07-27 15:08:03 +01:00
dm.h dm thin: commit before gathering status 2012-07-27 15:08:16 +01:00
faulty.c
linear.c
linear.h
md.c md: Don't truncate size at 4TB for RAID0 and Linear 2012-08-16 16:46:12 +10:00
md.h blk: pass from_schedule to non-request unplug functions. 2012-07-31 09:08:15 +02:00
multipath.c
multipath.h
raid0.c
raid0.h
raid1.c Additional md update for 3.6 2012-08-02 11:34:40 -07:00
raid1.h md/raid1: prevent merging too large request 2012-07-31 10:03:53 +10:00
raid5.c Additional md update for 3.6 2012-08-02 11:34:40 -07:00
raid5.h Additional md update for 3.6 2012-08-02 11:34:40 -07:00
raid10.c md/raid10: fix problem with on-stack allocation of r10bio structure. 2012-08-18 09:51:42 +10:00
raid10.h md/raid10: fix problem with on-stack allocation of r10bio structure. 2012-08-18 09:51:42 +10:00