aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/md/dm-ioctl.c
diff options
context:
space:
mode:
authorJun'ichi Nomura <j-nomura@ce.jp.nec.com>2007-12-13 09:15:25 -0500
committerAlasdair G Kergon <agk@redhat.com>2007-12-20 12:32:08 -0500
commit512875bd9661368da6f993205a61213b79ba1df0 (patch)
tree7a2e010060b6233cd02e2e36b62f5dcaa96c2c36 /drivers/md/dm-ioctl.c
parentfbdcf18df73758b2e187ab94678b30cd5f6ff9f9 (diff)
dm: table detect io beyond device
This patch fixes a panic on shrinking a DM device if there is outstanding I/O to the part of the device that is being removed. (Normally this doesn't happen - a filesystem would be resized first, for example.) The bug is that __clone_and_map() assumes dm_table_find_target() always returns a valid pointer. It may fail if a bio arrives from the block layer but its target sector is no longer included in the DM btree. This patch appends an empty entry to table->targets[] which will be returned by a lookup beyond the end of the device. After calling dm_table_find_target(), __clone_and_map() and target_message() check for this condition using dm_target_is_valid(). Sample test script to trigger oops:
Diffstat (limited to 'drivers/md/dm-ioctl.c')
-rw-r--r--drivers/md/dm-ioctl.c10
1 files changed, 3 insertions, 7 deletions
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 138200bf5e0b..be730fdd4830 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1250,21 +1250,17 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
1250 if (!table) 1250 if (!table)
1251 goto out_argv; 1251 goto out_argv;
1252 1252
1253 if (tmsg->sector >= dm_table_get_size(table)) { 1253 ti = dm_table_find_target(table, tmsg->sector);
1254 if (!dm_target_is_valid(ti)) {
1254 DMWARN("Target message sector outside device."); 1255 DMWARN("Target message sector outside device.");
1255 r = -EINVAL; 1256 r = -EINVAL;
1256 goto out_table; 1257 } else if (ti->type->message)
1257 }
1258
1259 ti = dm_table_find_target(table, tmsg->sector);
1260 if (ti->type->message)
1261 r = ti->type->message(ti, argc, argv); 1258 r = ti->type->message(ti, argc, argv);
1262 else { 1259 else {
1263 DMWARN("Target type does not support messages"); 1260 DMWARN("Target type does not support messages");
1264 r = -EINVAL; 1261 r = -EINVAL;
1265 } 1262 }
1266 1263
1267 out_table:
1268 dm_table_put(table); 1264 dm_table_put(table);
1269 out_argv: 1265 out_argv:
1270 kfree(argv); 1266 kfree(argv);