1. 16 Oct, 2013 1 commit
    • Mikulas Patocka's avatar
      dm snapshot: fix data corruption · e9c6a182
      Mikulas Patocka authored
      This patch fixes a particular type of data corruption that has been
      encountered when loading a snapshot's metadata from disk.
      
      When we allocate a new chunk in persistent_prepare, we increment
      ps->next_free and we make sure that it doesn't point to a metadata area
      by further incrementing it if necessary.
      
      When we load metadata from disk on device activation, ps->next_free is
      positioned after the last used data chunk. However, if this last used
      data chunk is followed by a metadata area, ps->next_free is positioned
      erroneously to the metadata area. A newly-allocated chunk is placed at
      the same location as the metadata area, resulting in data or metadata
      corruption.
      
      This patch changes the code so that ps->next_free skips the metadata
      area when metadata are loaded in function read_exceptions.
      
      The patch also moves a piece of code from persistent_prepare_exception
      to a separate function skip_metadata to avoid code duplication.
      
      CVE-2013-4299
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Cc: stable@vger.kernel.org
      Cc: Mike Snitzer <snitzer@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      e9c6a182
  2. 13 Oct, 2013 17 commits
  3. 12 Oct, 2013 10 commits
  4. 11 Oct, 2013 12 commits