Lars Ellenberg
4eccc57979
drbd: fix access of unallocated pages and kernel panic ...
BUG: unable to handle kernel NULL pointer dereference at (null)
...
[<d1e17561>] ? _drbd_bm_set_bits+0x151/0x240 [drbd]
[<d1e236f8>] ? receive_bitmap+0x4f8/0xbc0 [drbd]
This fixes an off-by-one error in the receive_bitmap() path,
if run-length encoded bitmap transfer is enabled.
If the bitmap is an exact multiple of PAGE_SIZE, which means the visible
capacity of the drbd device is an exact multiple of 128 MiB (for 4k page
size), and bitmap compression (use-rle) is enabled (which became default
with 8.4), and the very last bit is dirty and reported in an rle
comressed bitmap packet, we ended up trying to kmap_atomic a page pointer
that does not exist (bitmap->bm_pages[last index + 1]).
bug introduced by:
Date: Fri Jul 24 15:33:24 2009 +0200
set bits: optimize for complete last word, fix off-by-one-word corner case
made effective by:
Date: Thu Dec 16 00:32:38 2010 +0100
drbd: get rid of unused debug code
Long time ago, we had paranoia code in the bitmap that allocated one
extra word, assigned a magic value, and checked on every occasion that
the magic value was still unchanged.
That debug code is unused, the extra long word complicates code a bit.
Get rid of it.
No-one triggered this bug in the last few years, because a large subset
of our userbase is unaffected:
* typically the last few blocks of a device are not modified
frequently, and remain unset
* use-rle was disabled by default in drbd < 8.4
* those with slightly "odd" device sizes, or
* drbd internal meta data (which will skew the device size slightly,
thus makes it harder to have a bug relevant device size)
Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
2012-06-12 14:32:48 +02:00
Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2012-04-25 21:29:26 -07:00
ARM: 7366/3: amba: Remove AMBA level regulator support
2012-04-13 14:04:08 +01:00
libata: forbid port runtime pm by default, fixing regression
2012-04-18 14:33:25 -04:00
drivers/base: fix compiler warning in SoC export driver - idr should be ida
2012-04-09 14:54:22 -07:00
bcma: use fallback sprom if no on chip sprom is available
2012-04-16 13:32:01 -04:00
drbd: fix access of unallocated pages and kernel panic
2012-06-12 14:32:48 +02:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
2012-04-09 15:47:49 -04:00
tty and serial fixes for 3.4-rc2
2012-04-12 15:36:33 -07:00
Revert "clocksource: Load the ACPI PM clocksource asynchronously"
2012-04-12 00:05:05 +02:00
cpufreq: OMAP: fix build errors: depends on ARCH_OMAP2PLUS
2012-04-13 17:57:40 -07:00
Merge branches 'idle-fix' and 'misc' into release
2012-04-06 21:48:59 -04:00
crypto: talitos - properly lock access to global talitos registers
2012-04-09 15:13:40 +08:00
Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma
2012-04-26 15:33:36 -07:00
Merge branch 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile
2012-04-06 17:56:20 -07:00
ARM: pxa: fix gpio wakeup setting
2012-04-27 10:46:45 +08:00
drm/i915: Set the Stencil Cache eviction policy to non-LRA mode.
2012-04-28 08:05:15 +01:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
2012-04-20 10:39:33 -07:00
HSI: hsi_char: Remove max_data_size from sysfs
2012-04-23 14:23:32 +03:00
hwmon: (fam15h_power) Fix pci_device_id array
2012-04-26 08:40:08 -07:00
i2c: prevent spurious interrupt on Designware controllers
2012-04-10 08:09:03 -07:00
simple_open: automatically convert to simple_open()
2012-04-05 15:25:50 -07:00
A few fixes for regressions introduced in 3.4-rc1:
2012-04-26 15:35:35 -07:00
mfd: Convert twl6040 to i2c driver, and separate it from twl core
2012-04-16 16:45:34 +02:00
Merge branch 'akpm' (Andrew's patch-bomb)
2012-04-05 15:30:34 -07:00
tty and serial fixes for 3.4-rc2
2012-04-12 15:36:33 -07:00
leds-atmel-pwm.c: Make pwmled_probe() __devinit
2012-04-17 16:29:31 +02:00
md: fix possible corruption of array metadata on shutdown.
2012-04-24 10:23:16 +10:00
Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
2012-04-21 12:43:23 -07:00
mfd: Fix modular builds of rc5t583 regulator support
2012-04-16 21:27:07 +02:00
Merge branch 'akpm' (Andrew's patch-bomb)
2012-04-05 15:30:34 -07:00
Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma
2012-04-26 15:33:36 -07:00
Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma
2012-04-26 15:33:36 -07:00
drivers/net: Do not free an IRQ if its request failed
2012-04-21 16:41:11 -04:00
gpio: Fix range check in of_gpio_simple_xlate()
2012-04-10 14:20:56 -06:00
simple_open: automatically convert to simple_open()
2012-04-05 15:25:50 -07:00
Merge branch 'for-v3.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
2012-04-27 19:32:37 -07:00
pinctrl: implement pinctrl_check_ops
2012-04-11 09:31:02 +02:00
Merge branch 'akpm' (Andrew's patch-bomb)
2012-04-26 15:24:45 -07:00
Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux
2012-03-30 16:45:39 -07:00
Various small bugfixes and enhancements, plus two new drivers:
2012-03-30 16:09:02 -07:00
regulator: Fix a build warning in the anatop driver for 3.4
2012-04-10 10:26:41 -07:00
simple_open: automatically convert to simple_open()
2012-04-05 15:25:50 -07:00
drivers/rtc/rtc-ds1307.c: fix BUG shown with lock debugging enabled
2012-04-25 21:26:34 -07:00
[S390] s390/char/vmur.c: fix memory leak
2012-04-11 14:28:24 +02:00
SCSI: Fix error handling when no ULD is attached
2012-04-15 11:08:53 -07:00
spi/spi-bfin5xx: Fix flush of last bit after each spi transfer
2012-04-27 12:20:39 -06:00
staging: ozwpan: Fix bug where kfree is called twice.
2012-04-26 12:40:53 -07:00
tcm_fc: Do not free tpg structure during wq allocation failure
2012-04-06 18:57:05 -07:00
drivers/tty/amiserial.c: add missing tty_unlock
2012-04-19 19:15:35 -07:00
usb: fixes for v3.4-rc cycle
2012-04-27 07:50:34 -07:00
uwb: fix error handling
2012-04-18 13:15:51 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2012-04-22 21:02:57 -07:00
blackfin: fix compile error in bfin-lq035q1-fb.c
2012-04-26 14:46:51 -04:00
virtio_balloon: fix handling of PAGE_SIZE != 4k
2012-04-15 11:51:06 +03:00
hpwdt: Only BYTE reads/writes to WD Timer port 0x72
2012-04-26 14:38:07 +02:00
xen/acpi: Workaround broken BIOSes exporting non-existing C-states.
2012-04-26 22:07:28 -04:00
Merge branch 'for-next' of git://gitorious.org/kernel-hsi/kernel-hsi
2012-04-02 09:50:40 -07:00
Merge branch 'for-next' of git://gitorious.org/kernel-hsi/kernel-hsi
2012-04-02 09:50:40 -07:00
4eccc57979