linux/drivers/block, branch v2.6.33.9

Fix pktcdvd ioctl dev_minor range check

2011-03-21T19:45:04Z

commit 252a52aa4fa22a668f019e55b3aac3ff71ec1c29 upstream. The PKT_CTRL_CMD_STATUS device ioctl retrieves a pointer to a pktcdvd_device from the global pkt_devs array. The index into this array is provided directly by the user and is a signed integer, so the comparison to ensure that it falls within the bounds of this array will fail when provided with a negative index. This can be used to read arbitrary kernel memory or cause a crash due to an invalid pointer dereference. This can be exploited by users with permission to open /dev/pktcdvd/control (on many distributions, this is readable by group "cdrom"). Signed-off-by: Dan Rosenberg [ Rather than add a cast, just make the function take the right type -Linus ] Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

cciss: Make cciss_seq_show handle holes in the h->drv[] array

2010-02-05T12:15:36Z

It is possible (and expected) for there to be holes in the h->drv[] array, that is, some elements may be NULL pointers. cciss_seq_show needs to be made aware of this possibility to avoid an Oops. To reproduce the Oops which this fixes: 1) Create two "arrays" in the Array Configuratino Utility and several logical drives on each array. 2) cat /proc/driver/cciss/cciss* in an infinite loop 3) delete some of the logical drives in the first "array." Signed-off-by: Stephen M. Cameron Cc: stable@kernel.org Signed-off-by: Jens Axboe

pktcdvd: removing device does not remove its sysfs dir

2010-02-03T02:11:23Z

This is the counterpart to cba767175becadc5c4016cceb7bfdd2c7fe722f4 ("pktcdvd: remove broken dev_t export of class devices"). Device is not registered using dev_t, so it should not be destroyed using device_destroy which looks up the device by dev_t. This will fail and adding the device again will fail with the "duplicate name" error. This is fixed using device_unregister instead of device_destroy. Signed-off-by: Thadeu Lima de Souza Cascardo Cc: Kay Sievers Cc: Peter Osterlund Cc: Al Viro Cc: Jens Axboe Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

drbd: null dereference bug

2010-01-25T17:01:41Z

epoch is always NULL here. Signed-off-by: Dan Carpenter Signed-off-by: Philipp Reisner

drbd: fix max_segment_size initialization

2010-01-22T10:34:54Z

blk_queue_make_request() internally calls blk_set_default_limits(), so calling blk_queue_max_segment_size() before is useless. Ergo: move the call to blk_queue_max_segment_size() down a few lines. Impact: If, after a fresh modprobe, you first connect a Diskless drbd, then attach, this could result in a DRBD Protocol Error at first. The next connection attempt would then succeeded. Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg

drbd: Allow online resizing of DRBD devices while peer not reachable (needs to be explicitly forced)

2010-01-12T09:02:46Z

Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg

drbd: Don't go into StandAlone mode when authentification failes because of network error

2010-01-12T08:38:27Z

Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg

drbd: check on CONFIG_LBDAF, not LBD

2010-01-07T13:07:11Z

It is called LBDAF since 2.6.31. impact: without this change, on 32bit, DRBD would wrongly claim to only support 2TiB devices. Signed-off-by: Lars Ellenberg Signed-off-by: Philipp Reisner

drivers/block/drbd: Correct NULL test

2010-01-04T10:51:41Z

Test the just-allocated value for NULL rather than some other value. The semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @@ expression x,y; statement S; @@ x = \(kmalloc\|kcalloc\|kzalloc\)(...); ( if ((x) == NULL) S | if ( - y + x == NULL) S ) // Signed-off-by: Julia Lawall Signed-off-by: Philipp Reisner

drbd: Silenced an assert that could triggered after changing write ordering method

2009-12-31T08:33:09Z

Immediately after changing the write ordering method, the epoch can already be finished at this point. Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg