Patchwork [3.5.y.z,extended,stable] Patch "pnfs-block: removing DM device maybe cause oops when call" has been added to staging queue

mail settings
Submitter Luis Henriques
Date April 1, 2013, 3:04 p.m.
Message ID <>
Download mbox | patch
Permalink /patch/232751/
State New
Headers show


Luis Henriques - April 1, 2013, 3:04 p.m.
This is a note to let you know that I have just added a patch titled

    pnfs-block: removing DM device maybe cause oops when call

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 5ef7539ff5bc17c146b61cc1a036466fd244fc2e Mon Sep 17 00:00:00 2001
From: fanchaoting <>
Date: Thu, 21 Mar 2013 09:15:30 +0800
Subject: [PATCH] pnfs-block: removing DM device maybe cause oops when call

commit 4376c94618c26225e69e17b7c91169c45a90b292 upstream.

when pnfs block using device mapper,if umounting later,it maybe
cause oops. we apply "1 + sizeof(bl_umount_request)" memory for
msg->data, the memory maybe overflow when we do "memcpy(&dataptr
[sizeof(bl_msg)], &bl_umount_request, sizeof(bl_umount_request))",
because the size of bl_msg is more than 1 byte.

Signed-off-by: fanchaoting<>
Signed-off-by: Trond Myklebust <>
Signed-off-by: Luis Henriques <>
 fs/nfs/blocklayout/blocklayoutdm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)



diff --git a/fs/nfs/blocklayout/blocklayoutdm.c b/fs/nfs/blocklayout/blocklayoutdm.c
index 737d839..6fc7b5c 100644
--- a/fs/nfs/blocklayout/blocklayoutdm.c
+++ b/fs/nfs/blocklayout/blocklayoutdm.c
@@ -55,7 +55,8 @@  static void dev_remove(struct net *net, dev_t dev)

 	bl_pipe_msg.bl_wq = &nn->bl_wq;
 	memset(msg, 0, sizeof(*msg));
-	msg->data = kzalloc(1 + sizeof(bl_umount_request), GFP_NOFS);
+	msg->len = sizeof(bl_msg) + bl_msg.totallen;
+	msg->data = kzalloc(msg->len, GFP_NOFS);
 	if (!msg->data)
 		goto out;

@@ -66,7 +67,6 @@  static void dev_remove(struct net *net, dev_t dev)
 	memcpy(msg->data, &bl_msg, sizeof(bl_msg));
 	dataptr = (uint8_t *) msg->data;
 	memcpy(&dataptr[sizeof(bl_msg)], &bl_umount_request, sizeof(bl_umount_request));
-	msg->len = sizeof(bl_msg) + bl_msg.totallen;

 	add_wait_queue(&nn->bl_wq, &wq);
 	if (rpc_queue_upcall(nn->bl_device_pipe, msg) < 0) {