NeilBrown 2d4f4f3384 md/raid1: fix use-after-free bug in RAID1 data-check code. ... This bug has been present ever since data-check was introduce in 2.6.16. However it would only fire if a data-check were done on a degraded array, which was only possible if the array has 3 or more devices. This is certainly possible, but is quite uncommon. Since hot-replace was added in 3.3 it can happen more often as the same condition can arise if not all possible replacements are present. The problem is that as soon as we submit the last read request, the 'r1_bio' structure could be freed at any time, so we really should stop looking at it. If the last device is being read from we will stop looking at it. However if the last device is not due to be read from, we will still check the bio pointer in the r1_bio, but the r1_bio might already be free. So use the read_targets counter to make sure we stop looking for bios to submit as soon as we have submitted them all. This fix is suitable for any -stable kernel since 2.6.16. Cc: stable@vger.kernel.org Reported-by: Arnold Schulz <arnysch@gmx.net> Signed-off-by: NeilBrown <neilb@suse.de>		2012-07-09 11:34:13 +10:00
..
persistent-data	dm thin: provide userspace access to pool metadata	2012-06-03 00:30:01 +01:00
bitmap.c	md/bitmap: record the space available for the bitmap in the superblock.	2012-05-22 13:55:34 +10:00
bitmap.h	md/bitmap: record the space available for the bitmap in the superblock.	2012-05-22 13:55:34 +10:00
dm-bio-record.h
dm-bufio.c	dm bufio: prefetch	2012-03-28 18:41:29 +01:00
dm-bufio.h	dm bufio: prefetch	2012-03-28 18:41:29 +01:00
dm-crypt.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-delay.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-exception-store.c	dm exception store: fix init error path	2012-03-28 18:41:22 +01:00
dm-exception-store.h	dm snapshot: test chunk size against both origin and snapshot	2010-08-12 04:13:51 +01:00
dm-flakey.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-io.c	dm io: fix discard support	2012-03-07 19:09:37 +00:00
dm-ioctl.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-kcopyd.c	dm kcopyd: add dm_kcopyd_zero to zero an area	2011-10-31 20:18:58 +00:00
dm-linear.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-log-userspace-base.c	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
dm-log-userspace-transfer.c	connector/userns: replace netlink uses of cap_raised() with capable()	2012-05-10 23:21:39 -04:00
dm-log-userspace-transfer.h
dm-log.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-mpath.c	dm mpath: allow ioctls to trigger pg init	2012-06-03 00:29:58 +01:00
dm-mpath.h
dm-path-selector.c	md: Add module.h to all files using it implicitly	2011-10-31 19:31:18 -04:00
dm-path-selector.h
dm-queue-length.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-raid.c	DM RAID: Use md_error() in place of simply setting Faulty bit	2012-05-22 13:55:31 +10:00
dm-raid1.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-region-hash.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
dm-round-robin.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-service-time.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-snap-persistent.c	md: Add in export.h for files using EXPORT_SYMBOL	2011-10-31 19:31:19 -04:00
dm-snap-transient.c	md: Add in export.h for files using EXPORT_SYMBOL	2011-10-31 19:31:19 -04:00
dm-snap.c	dm snapshot: skip reading origin when overwriting complete chunk	2011-08-02 12:32:04 +01:00
dm-stripe.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-sysfs.c
dm-table.c	dm: reject trailing characters in sccanf input	2012-03-28 18:41:26 +01:00
dm-target.c	dm: error return error for discards	2010-08-12 04:14:14 +01:00
dm-thin-metadata.c	dm thin: provide userspace access to pool metadata	2012-06-03 00:30:01 +01:00
dm-thin-metadata.h	dm thin: provide userspace access to pool metadata	2012-06-03 00:30:01 +01:00
dm-thin.c	dm thin: provide userspace access to pool metadata	2012-06-03 00:30:01 +01:00
dm-uevent.c	md: Add in export.h for files using EXPORT_SYMBOL	2011-10-31 19:31:19 -04:00
dm-uevent.h
dm-verity.c	dm: add verity target	2012-03-28 18:43:38 +01:00
dm-zero.c	dm: zero silently drop discards	2010-08-12 04:14:12 +01:00
dm.c	dm: clear bi_end_io on remapping failure	2012-03-28 18:41:25 +01:00
dm.h	dm table: add immutable feature	2011-10-31 20:19:04 +00:00
faulty.c	md: tidy up rdev_for_each usage.	2012-03-19 12:46:39 +11:00
Kconfig	dm: add verity target	2012-03-28 18:43:38 +01:00
linear.c	md/linear: If md_integrity_register() fails, linear_run() must free the mem.	2012-04-02 09:48:37 +10:00
linear.h	md/linear: typedef removal: linear_conf_t -> struct linear_conf	2011-10-11 16:48:54 +11:00
Makefile	dm: add verity target	2012-03-28 18:43:38 +01:00
md.c	md: support re-add of recovering devices.	2012-07-03 15:59:06 +10:00
md.h	md/bitmap: add new 'space' attribute for bitmaps.	2012-05-22 13:55:07 +10:00
multipath.c	md: make 'name' arg to md_register_thread non-optional.	2012-07-03 15:56:52 +10:00
multipath.h	md/multipath: typedef removal: multipath_conf_t -> struct mpconf	2011-10-11 16:48:57 +11:00
raid0.c	md: Avoid OOPS when reshaping raid1 to raid0	2012-04-03 15:37:26 +10:00
raid0.h	md: add proper merge_bvec handling to RAID0 and Linear.	2012-03-19 12:46:39 +11:00
raid1.c	md/raid1: fix use-after-free bug in RAID1 data-check code.	2012-07-09 11:34:13 +10:00
raid1.h	md/raid1: Allocate spare to store replacement devices and their bios.	2011-12-23 10:17:56 +11:00
raid5.c	md: fix up plugging (again).	2012-07-03 17:45:31 +10:00
raid5.h	raid5: support sync request	2012-05-22 13:55:05 +10:00
raid10.c	md/raid10: fix careless build error	2012-07-04 09:35:35 +10:00
raid10.h	md/raid10: add reshape support	2012-05-22 13:53:47 +10:00