pnfs-block: removing DM device maybe cause oops when call dev_remove
authorfanchaoting <fanchaoting@cn.fujitsu.com>
Thu, 21 Mar 2013 01:15:30 +0000 (09:15 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 5 Apr 2013 17:04:30 +0000 (10:04 -0700)
commit75e4839c59268b4880b82fa9584980478ef8ca29
tree53983ab75f76f64d684f2ff1b899dd831b54877f
parente92c5efcb2af2afe9a7fa297dcc325f8d04469b3
pnfs-block: removing DM device maybe cause oops when call dev_remove

commit 4376c94618c26225e69e17b7c91169c45a90b292 upstream.

when pnfs block using device mapper,if umounting later,it maybe
cause oops. we apply "1 + sizeof(bl_umount_request)" memory for
msg->data, the memory maybe overflow when we do "memcpy(&dataptr
[sizeof(bl_msg)], &bl_umount_request, sizeof(bl_umount_request))",
because the size of bl_msg is more than 1 byte.

Signed-off-by: fanchaoting<fanchaoting@cn.fujitsu.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/nfs/blocklayout/blocklayoutdm.c