Mikulas Patocka 1ff004c41c dm snapshot: fix crash with transient storage and zero chunk size ...

commit c699a0db2d upstream.

The following commands will crash the kernel:

modprobe brd rd_size=1048576
dmsetup create o --table "0 `blockdev --getsize /dev/ram0` snapshot-origin /dev/ram0"
dmsetup create s --table "0 `blockdev --getsize /dev/ram0` snapshot /dev/ram0 /dev/ram1 N 0"

The reason is that when we test for zero chunk size, we jump to the label
bad_read_metadata without setting the "r" variable. The function
snapshot_ctr destroys all the structures and then exits with "r == 0". The
kernel then crashes because it falsely believes that snapshot_ctr
succeeded.

In order to fix the bug, we set the variable "r" to -EINVAL.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-05-26 11:48:33 +02:00

..

bcache

bcache: fix a lost wake-up problem caused by mca_cannibalize_lock

2020-10-01 13:14:27 +02:00

persistent-data

dm space map common: fix division bug in sm_ll_find_free_block()

2021-05-22 10:59:22 +02:00

dm-bio-prison-v1.c

dm: adjust structure members to improve alignment

2018-06-08 11:53:14 -04:00

dm-bio-prison-v1.h

block: switch bios to blk_status_t

2017-06-09 09:27:32 -06:00

dm-bio-prison-v2.c

dm: adjust structure members to improve alignment

2018-06-08 11:53:14 -04:00

dm-bio-prison-v2.h

dm bio prison v2: new interface for the bio prison

2017-03-07 11:30:16 -05:00

dm-bio-record.h

dm bio record: save/restore bi_end_io and bi_integrity

2020-03-25 08:06:07 +01:00

dm-bufio.c

dm bufio: subtract the number of initial sectors in dm_bufio_get_device_size

2021-03-11 14:04:59 +01:00

dm-builtin.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

dm-cache-background-tracker.c

dm cache background tracker: fix sparse warning

2018-04-30 15:40:40 -04:00

dm-cache-background-tracker.h

dm cache: significant rework to leverage dm-bio-prison-v2

2017-03-07 13:28:31 -05:00

dm-cache-block-types.h

linux: drop __bitwise__ everywhere

2016-12-16 00:13:41 +02:00

dm-cache-metadata.c

dm cache metadata: Avoid returning cmd->bm wild pointer on error

2020-09-09 19:04:31 +02:00

dm-cache-metadata.h

dm cache: significant rework to leverage dm-bio-prison-v2

2017-03-07 13:28:31 -05:00

dm-cache-policy-internal.h

dm cache: significant rework to leverage dm-bio-prison-v2

2017-03-07 13:28:31 -05:00

dm-cache-policy-smq.c

treewide: Use array_size() in vzalloc()

2018-06-12 16:19:22 -07:00

dm-cache-policy.c

dm cache: add policy name to status output

2014-01-16 13:44:11 -05:00

dm-cache-policy.h

dm cache: significant rework to leverage dm-bio-prison-v2

2017-03-07 13:28:31 -05:00

dm-cache-target.c

dm cache: fix a crash due to incorrect work item cancelling

2020-03-11 14:15:05 +01:00

dm-core.h

dm: fix deadlock when swapping to encrypted device

2021-03-04 09:39:57 +01:00

dm-crypt.c

dm: fix deadlock when swapping to encrypted device

2021-03-04 09:39:57 +01:00

dm-delay.c

dm delay: fix a crash when invalid device is specified

2019-05-25 18:23:39 +02:00

dm-era-target.c

dm era: Update in-core bitset after committing the metadata

2021-03-04 09:39:59 +01:00

dm-exception-store.c

Merge tag 'dm-4.4-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

2015-11-04 21:19:53 -08:00

dm-exception-store.h

dm snapshot: fix hung bios when copy error occurs

2016-01-08 20:03:05 -05:00

dm-flakey.c

dm flakey: Properly corrupt multi-page bios.

2019-12-05 09:20:36 +01:00

dm-integrity.c

dm integrity: conditionally disable "recalculate" feature

2021-01-30 13:32:13 +01:00

dm-io.c

dm: Use kzalloc for all structs with embedded biosets/mempools

2018-06-05 08:47:43 -06:00

dm-ioctl.c

dm ioctl: fix out of bounds array access when no devices

2021-03-30 14:36:59 +02:00

dm-kcopyd.c

dm kcopyd: always complete failed jobs

2019-08-29 08:28:55 +02:00

dm-linear.c

dm: Check for device sector overflow if CONFIG_LBDAF is not set

2019-01-26 09:32:42 +01:00

dm-log-userspace-base.c

dm: convert to bioset_init()/mempool_init()

2018-05-30 15:33:32 -06:00

dm-log-userspace-transfer.c

dm log userspace transfer: match wait_for_completion_timeout return type

2015-04-15 12:10:20 -04:00

dm-log-userspace-transfer.h

…

dm-log-writes.c

dm log writes: make sure super sector log updates are written in order

2019-07-03 13:14:45 +02:00

dm-log.c

block,fs: use REQ_* flags directly

2016-11-01 09:43:26 -06:00

dm-mpath.c

dm mpath: switch paths in dm_blk_ioctl() code path

2020-06-25 15:32:49 +02:00

dm-mpath.h

…

dm-path-selector.c

…

dm-path-selector.h

dm path selector: remove 'repeat_count' return from .select_path hook

2016-02-22 22:34:42 -05:00

dm-queue-length.c

dm mpath selector: more evenly distribute ties

2018-01-29 13:44:58 -05:00

dm-raid1.c

dm: Check for device sector overflow if CONFIG_LBDAF is not set

2019-01-26 09:32:42 +01:00

dm-raid.c

dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload sequences

2021-05-22 10:59:21 +02:00

dm-region-hash.c

Merge tag 'overflow-v4.18-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2018-06-12 18:28:00 -07:00

dm-round-robin.c

dm round robin: revert "use percpu 'repeat_count' and 'current_path'"

2017-02-17 00:54:09 -05:00

dm-rq.c

dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails

2021-05-22 10:59:23 +02:00

dm-rq.h

dm rq: do not update rq partially in each ending bio

2017-08-28 10:23:28 -04:00

dm-service-time.c

dm mpath selector: more evenly distribute ties

2018-01-29 13:44:58 -05:00

dm-snap-persistent.c

block: fix an integer overflow in logical block size

2020-01-23 08:21:29 +01:00

dm-snap-transient.c

dm snapshot: fix hung bios when copy error occurs

2016-01-08 20:03:05 -05:00

dm-snap.c

dm snapshot: fix crash with transient storage and zero chunk size

2021-05-26 11:48:33 +02:00

dm-stats.c

treewide: kmalloc() -> kmalloc_array()

2018-06-12 16:19:22 -07:00

dm-stats.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

dm-stripe.c

dax: Introduce a ->copy_to_iter dax operation

2018-05-22 23:18:31 -07:00

dm-switch.c

treewide: Use array_size() in vmalloc()

2018-06-12 16:19:22 -07:00

dm-sysfs.c

dm: move request-based code out to dm-rq.[hc]

2016-06-10 15:15:44 -04:00

dm-table.c

dm table: fix zoned iterate_devices based device capability checks

2021-03-11 14:05:01 +01:00

dm-target.c

dm mpath: fix missing call of path selector type->end_io

2019-09-16 08:22:12 +02:00

dm-thin-metadata.c

dm thin metadata: Avoid returning cmd->bm wild pointer on error

2020-09-09 19:04:31 +02:00

dm-thin-metadata.h

dm thin: fix passdown_double_checking_shared_status()

2019-01-31 08:14:38 +01:00

dm-thin.c

dm thin: add sanity checks to thin-pool and external snapshot creation

2019-04-05 22:32:59 +02:00

dm-uevent.c

…

dm-uevent.h

…

dm-unstripe.c

dm: Check for device sector overflow if CONFIG_LBDAF is not set

2019-01-26 09:32:42 +01:00

dm-verity-fec.c

dm verity fec: fix misaligned RS roots IO

2021-04-28 13:16:50 +02:00

dm-verity-fec.h

dm verity fec: fix misaligned RS roots IO

2021-04-28 13:16:50 +02:00

dm-verity-target.c

dm verity: add root hash pkcs#7 signature verification

2021-03-30 14:37:02 +02:00

dm-verity.h

dm verity: add 'check_at_most_once' option to only validate hashes once

2018-04-03 15:04:29 -04:00

dm-writecache.c

dm writecache: remove BUG() and fail gracefully instead

2020-12-11 13:25:04 +01:00

dm-zero.c

dm: don't return errnos from ->map

2017-06-09 09:27:32 -06:00

dm-zoned-metadata.c

dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone

2020-06-25 15:32:58 +02:00

dm-zoned-reclaim.c

dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone

2020-06-25 15:32:58 +02:00

dm-zoned-target.c

dm zoned: assign max_io_len correctly

2020-07-09 09:37:12 +02:00

dm-zoned.h

dm zoned: reduce overhead of backing device checks

2019-12-17 20:34:53 +01:00

dm.c

dm: fix deadlock when swapping to encrypted device

2021-03-04 09:39:57 +01:00

dm.h

dm: move dm_table_destroy() to same header as dm_table_create()

2018-01-17 09:16:06 -05:00

Kconfig

dm: add writecache target

2018-06-08 11:59:51 -04:00

Makefile

dm: add writecache target

2018-06-08 11:59:51 -04:00

md-bitmap.c

md/bitmap: wait for external bitmap writes to complete during tear down

2021-05-22 10:59:24 +02:00

md-bitmap.h

md: Avoid namespace collision with bitmap API

2018-08-01 15:49:39 -07:00

md-cluster.c

md/cluster: fix deadlock when node is doing resync job

2020-12-30 11:26:16 +01:00

md-cluster.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

md-faulty.c

md: convert to bioset_init()/mempool_init()

2018-05-30 15:33:32 -06:00

md-linear.c

md: improve handling of bio with REQ_PREFLUSH in md_flush_request()

2019-12-17 20:34:55 +01:00

md-linear.h

Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md

2017-11-14 16:07:26 -08:00

md-multipath.c

md: improve handling of bio with REQ_PREFLUSH in md_flush_request()

2019-12-17 20:34:55 +01:00

md-multipath.h

md: convert to bioset_init()/mempool_init()

2018-05-30 15:33:32 -06:00

md.c

md: Fix missing unused status line of /proc/mdstat

2021-05-22 10:59:25 +02:00

md.h

md: improve handling of bio with REQ_PREFLUSH in md_flush_request()

2019-12-17 20:34:55 +01:00

raid0.c

md: add feature flag MD_FEATURE_RAID0_LAYOUT

2020-06-25 15:33:10 +02:00

raid0.h

md/raid0: avoid RAID0 data corruption due to layout confusion.

2019-10-05 13:10:12 +02:00

raid1-10.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

raid1.c

md/raid1: properly indicate failure when ending a failed write request

2021-05-22 10:59:20 +02:00

raid1.h

md: convert to bioset_init()/mempool_init()

2018-05-30 15:33:32 -06:00

raid5-cache.c

md/raid5: fix 'out of memory' during raid cache recovery

2019-02-06 17:30:16 +01:00

raid5-log.h

md/raid5-cache: disable reshape completely

2018-08-31 17:38:09 -07:00

raid5-ppl.c

md: convert to bioset_init()/mempool_init()

2018-05-30 15:33:32 -06:00

raid5.c

md/raid5: fix oops during stripe resizing

2020-11-05 11:08:45 +01:00

raid5.h

Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md

2018-06-09 12:01:36 -07:00

raid10.c

md/raid10: initialize r10_bio->read_slot before use.

2021-01-06 14:44:58 +01:00

raid10.h

md: convert to bioset_init()/mempool_init()

2018-05-30 15:33:32 -06:00