NeilBrown 2d4f4f3384 md/raid1: fix use-after-free bug in RAID1 data-check code. ... This bug has been present ever since data-check was introduce in 2.6.16. However it would only fire if a data-check were done on a degraded array, which was only possible if the array has 3 or more devices. This is certainly possible, but is quite uncommon. Since hot-replace was added in 3.3 it can happen more often as the same condition can arise if not all possible replacements are present. The problem is that as soon as we submit the last read request, the 'r1_bio' structure could be freed at any time, so we really should stop looking at it. If the last device is being read from we will stop looking at it. However if the last device is not due to be read from, we will still check the bio pointer in the r1_bio, but the r1_bio might already be free. So use the read_targets counter to make sure we stop looking for bios to submit as soon as we have submitted them all. This fix is suitable for any -stable kernel since 2.6.16. Cc: stable@vger.kernel.org Reported-by: Arnold Schulz <arnysch@gmx.net> Signed-off-by: NeilBrown <neilb@suse.de>		2012-07-09 11:34:13 +10:00
..
accessibility
acpi	Merge branches 'bugfix-battery', 'bugfix-misc', 'bugfix-rafael', 'bugfix-turbostat', 'bugfix-video' and 'workaround-pss' into release	2012-06-04 00:48:41 -04:00
amba	arm-soc: driver specific updates	2012-05-26 12:22:27 -07:00
ata	Viresh has moved	2012-06-20 14:39:36 -07:00
atm	solos-pci: Fix DMA support	2012-05-24 16:22:53 -04:00
auxdisplay
base	Driver core and printk fixes for 3.5-rc4	2012-06-20 15:14:28 -07:00
bcma	bcma: fix null pointer in bcma_core_pci_irq_ctl	2012-06-08 13:47:07 -04:00
block	mtip32xx: Changes to sysfs entries	2012-05-31 08:46:50 +02:00
bluetooth
cdrom
char	Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2012-06-18 12:20:36 -07:00
clk	Viresh has moved	2012-06-20 14:39:36 -07:00
clocksource	clocksource: sh_tmu: Use clockevents_config_and_register().	2012-06-11 17:10:16 +09:00
connector
cpufreq
cpuidle
crypto	arm-soc: clock driver changes	2012-05-26 12:42:29 -07:00
dca
devfreq
dio
dma	Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma	2012-06-20 22:12:52 -07:00
edac	edac: Do alignment logic properly in edac_align_ptr()	2012-06-11 12:43:16 -03:00
eisa
extcon	extcon: max8997: Add missing kfree for info->edev in max8997_muic_remove()	2012-06-18 16:30:42 -07:00
firewire
firmware
gpio	gpio/samsung: fix the typo 'exynos5_xxx' instead of 'exonys5_xxx'	2012-06-03 21:21:01 -07:00
gpu	drm/edid: don't return stack garbage from supports_rb	2012-06-21 09:34:13 +01:00
hid
hsi
hv
hwmon	hwmon fixes for 3.5-rc4	2012-06-21 13:40:40 -07:00
hwspinlock
i2c	i2c: Add generic I2C multiplexer using pinctrl API	2012-06-04 16:49:43 +02:00
ide	drivers/ide/ide-cs.c: adjust suspicious bit operation	2012-06-12 15:51:41 -07:00
idle
ieee802154
iio	iio: drop wrong reference from Kconfig	2012-06-14 17:28:46 -07:00
infiniband	Merge branches 'cma' and 'ocrdma' into for-linus	2012-06-24 04:59:59 -07:00
input	i2c: Split I2C_M_NOSTART support out of I2C_FUNC_PROTOCOL_MANGLING	2012-05-30 10:55:34 +02:00
iommu	iommu/amd: Fix deadlock in ppr-handling error path	2012-06-04 12:47:44 +02:00
isdn
leds	leds: Make LEDS_ASIC3 and LEDS_RENESAS_TPU depend on LEDS_CLASS=y	2012-06-12 10:56:25 +08:00
lguest
macintosh
md	md/raid1: fix use-after-free bug in RAID1 data-check code.	2012-07-09 11:34:13 +10:00
media	media: pms.c needs linux/slab.h	2012-06-20 22:10:08 -07:00
memory
memstick
message	Merge branch 'akpm' (Andrew's patch-bomb)	2012-05-31 18:10:18 -07:00
mfd	Viresh has moved	2012-06-20 14:39:36 -07:00
misc	misc: mei: set WDIOF_ALARMONLY on mei watchdog	2012-06-13 15:34:31 -07:00
mmc	Merge branch 'akpm' (Andrew's patch-bomb)	2012-06-20 14:41:57 -07:00
mtd	kmsg - kmsg_dump() use iterator to receive log buffer content	2012-06-15 14:53:59 -07:00
net	Fix typo in printed messages	2012-06-24 11:03:52 -07:00
nfc	NFC: potential integer overflow problem in check_crc()	2012-05-25 11:16:16 -04:00
nubus
of	Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus	2012-05-29 18:27:19 -07:00
oprofile
parisc
parport
pci	USB: add NO_D3_DURING_SLEEP flag and revert 151b612847	2012-06-13 13:11:39 -07:00
pcmcia
pinctrl	Merge branch 'akpm' (Andrew's patch-bomb)	2012-06-20 14:41:57 -07:00
platform	drivers/platform/x86/acerhdf.c: correct Boris' mail address	2012-06-07 14:43:55 -07:00
pnp
power	A bunch of fixes for v3.5, nothing extraordinary.	2012-05-31 12:10:15 -07:00
pps
ps3
ptp
rapidio	rapidio/tsi721: add DMA engine support	2012-05-31 17:49:31 -07:00
regulator	regulator: Change db8500-prcmu match names to reflect Device Tree	2012-06-17 18:27:49 +01:00
remoteproc	remoteproc/omap: fix dev_err typo	2012-06-17 10:31:03 +03:00
rpmsg
rtc	Merge branches 'bugfix-battery', 'bugfix-misc', 'bugfix-rafael', 'bugfix-turbostat', 'bugfix-video' and 'workaround-pss' into release	2012-06-04 00:48:41 -04:00
s390	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux	2012-05-31 10:51:10 -07:00
sbus
scsi	SCSI fixes on 20120614	2012-06-15 17:39:32 -07:00
sfi
sh
sn
spi	SPI: fix over-eager devm_xxx() conversion	2012-06-18 11:27:04 +01:00
ssb
staging	staging tree fixes for 3.5-rc4	2012-06-20 15:15:03 -07:00
target	target: Return error to initiator if SET TARGET PORT GROUPS emulation fails	2012-06-12 20:12:25 -07:00
tc
thermal
tty	Serial driver fixes for 3.5-rc4	2012-06-20 15:13:13 -07:00
uio
usb	USB: fix gathering of interface associations	2012-06-14 17:13:34 -07:00
uwb
vhost
video	fbdev fixes for 3.5	2012-06-16 16:59:05 -07:00
virt
virtio
vlynq
vme
w1	arm-soc: clock driver changes	2012-05-26 12:42:29 -07:00
watchdog	Viresh has moved	2012-06-20 14:39:36 -07:00
xen	Five bug-fixes:	2012-06-15 17:17:15 -07:00
zorro
Kconfig
Makefile	arm-soc: driver specific updates	2012-05-26 12:22:27 -07:00