1. 02 3月, 2013 1 次提交
    • M
      dm: fix truncated status strings · fd7c092e
      Mikulas Patocka 提交于
      Avoid returning a truncated table or status string instead of setting
      the DM_BUFFER_FULL_FLAG when the last target of a table fills the
      buffer.
      
      When processing a table or status request, the function retrieve_status
      calls ti->type->status. If ti->type->status returns non-zero,
      retrieve_status assumes that the buffer overflowed and sets
      DM_BUFFER_FULL_FLAG.
      
      However, targets don't return non-zero values from their status method
      on overflow. Most targets returns always zero.
      
      If a buffer overflow happens in a target that is not the last in the
      table, it gets noticed during the next iteration of the loop in
      retrieve_status; but if a buffer overflow happens in the last target, it
      goes unnoticed and erroneously truncated data is returned.
      
      In the current code, the targets behave in the following way:
      * dm-crypt returns -ENOMEM if there is not enough space to store the
        key, but it returns 0 on all other overflows.
      * dm-thin returns errors from the status method if a disk error happened.
        This is incorrect because retrieve_status doesn't check the error
        code, it assumes that all non-zero values mean buffer overflow.
      * all the other targets always return 0.
      
      This patch changes the ti->type->status function to return void (because
      most targets don't use the return code). Overflow is detected in
      retrieve_status: if the status method fills up the remaining space
      completely, it is assumed that buffer overflow happened.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      fd7c092e
  2. 22 12月, 2012 2 次提交
  3. 27 7月, 2012 1 次提交
    • A
      dm thin: commit before gathering status · 1f4e0ff0
      Alasdair G Kergon 提交于
      Commit outstanding metadata before returning the status for a dm thin
      pool so that the numbers reported are as up-to-date as possible.
      
      The commit is not performed if the device is suspended or if
      the DM_NOFLUSH_FLAG is supplied by userspace and passed to the target
      through a new 'status_flags' parameter in the target's dm_status_fn.
      
      The userspace dmsetup tool will support the --noflush flag with the
      'dmsetup status' and 'dmsetup wait' commands from version 1.02.76
      onwards.
      Tested-by: NMike Snitzer <snitzer@redhat.com>
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      1f4e0ff0
  4. 29 3月, 2012 1 次提交
    • M
      dm: reject trailing characters in sccanf input · 31998ef1
      Mikulas Patocka 提交于
      Device mapper uses sscanf to convert arguments to numbers. The problem is that
      the way we use it ignores additional unmatched characters in the scanned string.
      
      For example, this `if (sscanf(string, "%d", &number) == 1)' will match a number,
      but also it will match number with some garbage appended, like "123abc".
      
      As a result, device mapper accepts garbage after some numbers. For example
      the command `dmsetup create vg1-new --table "0 16384 linear 254:1bla 34816bla"'
      will pass without an error.
      
      This patch fixes all sscanf uses in device mapper. It appends "%c" with
      a pointer to a dummy character variable to every sscanf statement.
      
      The construct `if (sscanf(string, "%d%c", &number, &dummy) == 1)' succeeds
      only if string is a null-terminated number (optionally preceded by some
      whitespace characters). If there is some character appended after the number,
      sscanf matches "%c", writes the character to the dummy variable and returns 2.
      We check the return value for 1 and consequently reject numbers with some
      garbage appended.
      Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
      Acked-by: NMike Snitzer <snitzer@redhat.com>
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      31998ef1
  5. 08 3月, 2012 1 次提交
    • M
      dm flakey: fix crash on read when corrupt_bio_byte not set · 1212268f
      Mike Snitzer 提交于
      The following BUG is hit on the first read that is submitted to a dm
      flakey test device while the device is "down" if the corrupt_bio_byte
      feature wasn't requested when the device's table was loaded.
      
      Example DM table that will hit this BUG:
      0 2097152 flakey 8:0 2048 0 30
      
      This bug was introduced by commit a3998799
      (dm flakey: add corrupt_bio_byte feature) in v3.1-rc1.
      
      BUG: unable to handle kernel paging request at ffff8801cfce3fff
      IP: [<ffffffffa008c233>] corrupt_bio_data+0x6e/0xae [dm_flakey]
      PGD 1606063 PUD 0
      Oops: 0002 [#1] SMP
      ...
      Call Trace:
       <IRQ>
       [<ffffffffa008c2b5>] flakey_end_io+0x42/0x48 [dm_flakey]
       [<ffffffffa00dca98>] clone_endio+0x54/0xb6 [dm_mod]
       [<ffffffff81130587>] bio_endio+0x2d/0x2f
       [<ffffffff811c819a>] req_bio_endio+0x96/0x9f
       [<ffffffff811c94b9>] blk_update_request+0x1dc/0x3a9
       [<ffffffff812f5ee2>] ? rcu_read_unlock+0x21/0x23
       [<ffffffff811c96a6>] blk_update_bidi_request+0x20/0x6e
       [<ffffffff811c9713>] blk_end_bidi_request+0x1f/0x5d
       [<ffffffff811c978d>] blk_end_request+0x10/0x12
       [<ffffffff8128f450>] scsi_io_completion+0x1e5/0x4b1
       [<ffffffff812882a9>] scsi_finish_command+0xec/0xf5
       [<ffffffff8128f830>] scsi_softirq_done+0xff/0x108
       [<ffffffff811ce284>] blk_done_softirq+0x84/0x98
       [<ffffffff81048d19>] __do_softirq+0xe3/0x1d5
       [<ffffffff8138f83f>] ? _raw_spin_lock+0x62/0x69
       [<ffffffff810997cf>] ? handle_irq_event+0x4c/0x61
       [<ffffffff8139833c>] call_softirq+0x1c/0x30
       [<ffffffff81003b37>] do_softirq+0x4b/0xa3
       [<ffffffff81048a39>] irq_exit+0x53/0xca
       [<ffffffff81398acd>] do_IRQ+0x9d/0xb4
       [<ffffffff81390333>] common_interrupt+0x73/0x73
      ...
      Signed-off-by: NMike Snitzer <snitzer@redhat.com>
      Cc: stable@vger.kernel.org # 3.1+
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      1212268f
  6. 15 1月, 2012 1 次提交
  7. 26 9月, 2011 1 次提交
  8. 02 8月, 2011 4 次提交
  9. 24 3月, 2011 1 次提交