litmus-rt.git - The LITMUS^RT kernel.

diff options

author	NeilBrown <neilb@suse.de>	2012-07-08 21:34:13 -0400
committer	NeilBrown <neilb@suse.de>	2012-07-08 21:34:13 -0400
commit	2d4f4f3384d4ef4f7c571448e803a1ce721113d5 (patch)
tree	6da1215ad5e15314aa41194ac9b0a13a8c3a2a00 /kernel/fork.c
parent	10684112c9d154172ac34e48a2ab68649e8f63ac (diff)

md/raid1: fix use-after-free bug in RAID1 data-check code.

This bug has been present ever since data-check was introduce in 2.6.16. However it would only fire if a data-check were done on a degraded array, which was only possible if the array has 3 or more devices. This is certainly possible, but is quite uncommon. Since hot-replace was added in 3.3 it can happen more often as the same condition can arise if not all possible replacements are present. The problem is that as soon as we submit the last read request, the 'r1_bio' structure could be freed at any time, so we really should stop looking at it. If the last device is being read from we will stop looking at it. However if the last device is not due to be read from, we will still check the bio pointer in the r1_bio, but the r1_bio might already be free. So use the read_targets counter to make sure we stop looking for bios to submit as soon as we have submitted them all. This fix is suitable for any -stable kernel since 2.6.16. Cc: stable@vger.kernel.org Reported-by: Arnold Schulz <arnysch@gmx.net> Signed-off-by: NeilBrown <neilb@suse.de>

Diffstat (limited to 'kernel/fork.c')

0 files changed, 0 insertions, 0 deletions

/* * "LAPB via ethernet" driver release 001 * * This code REQUIRES 2.1.15 or higher/ NET3.038 * * This module: * This module is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version * 2 of the License, or (at your option) any later version. * * This is a "pseudo" network driver to allow LAPB over Ethernet. * * This driver can use any ethernet destination address, and can be * limited to accept frames from one dedicated ethernet card only. * * History * LAPBETH 001 Jonathan Naylor Cloned from bpqether.c * 2000-10-29 Henner Eisen lapb_data_indication() return status. * 2000-11-14 Henner Eisen dev_hold/put, NETDEV_GOING_DOWN support */ #include <linux/errno.h> #include <linux/types.h> #include <linux/socket.h> #include <linux/in.h> #include <linux/kernel.h> #include <linux/string.h> #include <linux/net.h> #include <linux/inet.h> #include <linux/netdevice.h> #include <linux/if_arp.h> #include <linux/skbuff.h> #include <net/sock.h> #include <asm/system.h> #include <asm/uaccess.h> #include <linux/mm.h> #include <linux/interrupt.h> #include <linux/notifier.h> #include <linux/stat.h> #include <linux/netfilter.h> #include <linux/module.h> #include <linux/lapb.h> #include <linux/init.h> #include <net/x25device.h> static char bcast_addr[6] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF }; /* If this number is made larger, check that the temporary string buffer * in lapbeth_new_device is large enough to store the probe device name.*/ #define MAXLAPBDEV 100 struct lapbethdev { struct list_head node; struct net_device *ethdev; /* link to ethernet device */ struct net_device *axdev; /* lapbeth device (lapb#) */ struct net_device_stats stats; /* some statistics */ }; static struct list_head lapbeth_devices = LIST_HEAD_INIT(lapbeth_devices); /* ------------------------------------------------------------------------ */ /* * Get the LAPB device for the ethernet device */ static struct lapbethdev *lapbeth_get_x25_dev(struct net_device *dev) { struct lapbethdev *lapbeth; list_for_each_entry_rcu(lapbeth, &lapbeth_devices, node) { if (lapbeth->ethdev == dev) return lapbeth; } return NULL; } static __inline__ int dev_is_ethdev(struct net_device *dev) { return dev->type == ARPHRD_ETHER && strncmp(dev->name, "dummy", 5); } /* ------------------------------------------------------------------------ */ /* * Receive a LAPB frame via an ethernet interface. */ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *ptype, struct net_device *orig_dev) { int len, err; struct lapbethdev *lapbeth; if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) return NET_RX_DROP; if (!pskb_may_pull(skb, 2)) goto drop; rcu_read_lock(); lapbeth = lapbeth_get_x25_dev(dev); if (!lapbeth) goto drop_unlock; if (!netif_running(lapbeth->axdev)) goto drop_unlock; lapbeth->stats.rx_packets++; len = skb->data[0] + skb->data[1] * 256; lapbeth->stats.rx_bytes += len; skb_pull(skb, 2); /* Remove the length bytes */ skb_trim(skb, len); /* Set the length of the data */ if ((err = lapb_data_received(lapbeth->axdev, skb)) != LAPB_OK) { printk(KERN_DEBUG "lapbether: lapb_data_received err - %d\n", err); goto drop_unlock; } out: rcu_read_unlock(); return 0; drop_unlock: kfree_skb(skb); goto out; drop: kfree_skb(skb); return 0; } static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb) { unsigned char *ptr; skb_push(skb, 1); if (skb_cow(skb, 1)) return NET_RX_DROP; ptr = skb->data; *ptr = 0x00; skb->protocol = x25_type_trans(skb, dev); skb->dev->last_rx = jiffies; return netif_rx(skb); } /* * Send a LAPB frame via an ethernet interface */ static int lapbeth_xmit(struct sk_buff *skb, struct net_device *dev) { int err = -ENODEV; /* * Just to be *really* sure not to send anything if the interface * is down, the ethernet device may have gone. */ if (!netif_running(dev)) { goto drop; } switch (skb->data[0]) { case 0x00: err = 0; break; case 0x01: if ((err = lapb_connect_request(dev)) != LAPB_OK) printk(KERN_ERR "lapbeth: lapb_connect_request " "error: %d\n", err); goto drop_ok; case 0x02: if ((err = lapb_disconnect_request(dev)) != LAPB_OK) printk(KERN_ERR "lapbeth: lapb_disconnect_request " "err: %d\n", err); /* Fall thru */ default: goto drop_ok; } skb_pull(skb, 1); if ((err = lapb_data_request(dev, skb)) != LAPB_OK) { printk(KERN_ERR "lapbeth: lapb_data_request error - %d\n", err); err = -ENOMEM; goto drop; } err = 0; out: return err; drop_ok: err = 0; drop: kfree_skb(skb); goto out; } static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb) { struct lapbethdev *lapbeth = netdev_priv(ndev); unsigned char *ptr; struct net_device *dev; int size = skb->len; skb->protocol = htons(ETH_P_X25); ptr = skb_push(skb, 2); *ptr++ = size % 256; *ptr++ = size / 256; lapbeth->stats.tx_packets++; lapbeth->stats.tx_bytes += size; skb->dev = dev = lapbeth->ethdev; dev->hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0); dev_queue_xmit(skb); } static void lapbeth_connected(struct net_device *dev, int reason) { unsigned char *ptr; struct sk_buff *skb = dev_alloc_skb(1); if (!skb) { printk(KERN_ERR "lapbeth: out of memory\n"); return; } ptr = skb_put(skb, 1); *ptr = 0x01; skb->protocol = x25_type_trans(skb, dev); skb->dev->last_rx = jiffies; netif_rx(skb); } static void lapbeth_disconnected(struct net_device *dev, int reason) { unsigned char *ptr; struct sk_buff *skb = dev_alloc_skb(1); if (!skb) { printk(KERN_ERR "lapbeth: out of memory\n"); return; } ptr = skb_put(skb, 1); *ptr = 0x02; skb->protocol = x25_type_trans(skb, dev); skb->dev->last_rx = jiffies; netif_rx(skb); } /* * Statistics */ static struct net_device_stats *lapbeth_get_stats(struct net_device *dev) { struct lapbethdev *lapbeth = netdev_priv(dev); return &lapbeth->stats; } /* * Set AX.25 callsign */ static int lapbeth_set_mac_address(struct net_device *dev, void *addr) { struct sockaddr *sa = addr; memcpy(dev->dev_addr, sa->sa_data, dev->addr_len); return 0; } static struct lapb_register_struct lapbeth_callbacks = { .connect_confirmation = lapbeth_connected,


context:
space:
mode: