From: Andi Kleen <andi@firstfloor.org>
To: namhyung@gmail.com, Laurent.Vivier@bull.net,
Paul.Clements@steeleye.com, jaxboe@fusionio.com, gregkh@suse.de,
ak@linux.intel.com, linux-kernel@vger.kernel.org,
stable@kernel.org, tim.bird@am.sony.com
Subject: [PATCH] [36/99] nbd: limit module parameters to a sane value
Date: Wed, 27 Jul 2011 14:48:34 -0700 (PDT) [thread overview]
Message-ID: <20110727214834.EEF092403FF@tassilo.jf.intel.com> (raw)
In-Reply-To: <20110727247.325703029@firstfloor.org>
2.6.35-longterm review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@gmail.com>
commit 3b2710824e00d238554c13b5add347e6c701ab1a upstream.
The 'max_part' parameter controls the number of maximum partition
a nbd device can have. However if a user specifies very large
value it would exceed the limitation of device minor number and
can cause a kernel oops (or, at least, produce invalid device
nodes in some cases).
In addition, specifying large 'nbds_max' value causes same
problem for the same reason.
On my desktop, following command results to the kernel bug:
$ sudo modprobe nbd max_part=100000
kernel BUG at /media/Linux_Data/project/linux/fs/sysfs/group.c:65!
invalid opcode: 0000 [#1] SMP
last sysfs file: /sys/devices/virtual/block/nbd4/range
CPU 1
Modules linked in: nbd(+) bridge stp llc kvm_intel kvm asus_atk0110 sg sr_mod cdrom
Pid: 2522, comm: modprobe Tainted: G W 2.6.39-leonard+ #159 System manufacturer System Product Name/P5G41TD-M PRO
RIP: 0010:[<ffffffff8115aa08>] [<ffffffff8115aa08>] internal_create_group+0x2f/0x166
RSP: 0018:ffff8801009f1de8 EFLAGS: 00010246
RAX: 00000000ffffffef RBX: ffff880103920478 RCX: 00000000000a7bd3
RDX: ffffffff81a2dbe0 RSI: 0000000000000000 RDI: ffff880103920478
RBP: ffff8801009f1e38 R08: ffff880103920468 R09: ffff880103920478
R10: ffff8801009f1de8 R11: ffff88011eccbb68 R12: ffffffff81a2dbe0
R13: ffff880103920468 R14: 0000000000000000 R15: ffff880103920400
FS: 00007f3c49de9700(0000) GS:ffff88011f800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007f3b7fe7c000 CR3: 00000000cd58d000 CR4: 00000000000406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process modprobe (pid: 2522, threadinfo ffff8801009f0000, task ffff8801009a93a0)
Stack:
ffff8801009f1e58 ffffffff812e8f6e ffff8801009f1e58 ffffffff812e7a80
ffff880000000010 ffff880103920400 ffff8801002fd0c0 ffff880103920468
0000000000000011 ffff880103920400 ffff8801009f1e48 ffffffff8115ab6a
Call Trace:
[<ffffffff812e8f6e>] ? device_add+0x4f1/0x5e4
[<ffffffff812e7a80>] ? dev_set_name+0x41/0x43
[<ffffffff8115ab6a>] sysfs_create_group+0x13/0x15
[<ffffffff810b857e>] blk_trace_init_sysfs+0x14/0x16
[<ffffffff811ee58b>] blk_register_queue+0x4c/0xfd
[<ffffffff811f3bdf>] add_disk+0xe4/0x29c
[<ffffffffa007e2ab>] nbd_init+0x2ab/0x30d [nbd]
[<ffffffffa007e000>] ? 0xffffffffa007dfff
[<ffffffff8100020f>] do_one_initcall+0x7f/0x13e
[<ffffffff8107ab0a>] sys_init_module+0xa1/0x1e3
[<ffffffff814f3542>] system_call_fastpath+0x16/0x1b
Code: 41 57 41 56 41 55 41 54 53 48 83 ec 28 0f 1f 44 00 00 48 89 fb 41 89 f6 49 89 d4 48 85 ff 74 0b 85 f6 75 0b 48 83
7f 30 00 75 14 <0f> 0b eb fe b9 ea ff ff ff 48 83 7f 30 00 0f 84 09 01 00 00 49
RIP [<ffffffff8115aa08>] internal_create_group+0x2f/0x166
RSP <ffff8801009f1de8>
---[ end trace 753285ffbf72c57c ]---
Signed-off-by: Namhyung Kim <namhyung@gmail.com>
Cc: Laurent Vivier <Laurent.Vivier@bull.net>
Cc: Paul Clements <Paul.Clements@steeleye.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
---
drivers/block/nbd.c | 6 ++++++
1 file changed, 6 insertions(+)
Index: linux-2.6.35.y/drivers/block/nbd.c
===================================================================
--- linux-2.6.35.y.orig/drivers/block/nbd.c
+++ linux-2.6.35.y/drivers/block/nbd.c
@@ -755,6 +755,12 @@ static int __init nbd_init(void)
if (max_part > 0)
part_shift = fls(max_part);
+ if ((1UL << part_shift) > DISK_MAX_PARTS)
+ return -EINVAL;
+
+ if (nbds_max > 1UL << (MINORBITS - part_shift))
+ return -EINVAL;
+
for (i = 0; i < nbds_max; i++) {
struct gendisk *disk = alloc_disk(1 << part_shift);
if (!disk)
next prev parent reply other threads:[~2011-07-27 22:04 UTC|newest]
Thread overview: 110+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-07-27 21:47 [PATCH] [0/99] 2.6.35.14 longterm review Andi Kleen
2011-07-27 21:47 ` [PATCH] [1/99] x86, amd: Do not enable ARAT feature on AMD processors below Andi Kleen
2011-07-27 21:48 ` [PATCH] [2/99] x86, amd: Use _safe() msr access for GartTlbWlk disable code Andi Kleen
2011-07-27 21:48 ` [PATCH] [3/99] rcu: Fix unpaired rcu_irq_enter() from locking selftests Andi Kleen
2011-07-27 21:48 ` [PATCH] [4/99] staging: usbip: fix wrong endian conversion Andi Kleen
2011-07-27 21:48 ` [PATCH] [5/99] Fix for buffer overflow in ldm_frag_add not sufficient Andi Kleen
2011-07-27 21:48 ` [PATCH] [6/99] seqlock: Don't smp_rmb in seqlock reader spin loop Andi Kleen
2011-07-27 21:48 ` [PATCH] [7/99] ALSA: HDA: Use one dmic only for Dell Studio 1558 Andi Kleen
2011-07-27 21:48 ` [PATCH] [8/99] ASoC: Ensure output PGA is enabled for line outputs in Andi Kleen
2011-07-27 21:48 ` [PATCH] [9/99] ASoC: Add some missing volume update bit sets for wm_hubs Andi Kleen
2011-07-27 21:48 ` [PATCH] [10/99] mm/page_alloc.c: prevent unending loop in Andi Kleen
2011-07-27 21:48 ` [PATCH] [11/99] loop: limit 'max_part' module param to DISK_MAX_PARTS Andi Kleen
2011-07-27 21:48 ` [PATCH] [12/99] loop: handle on-demand devices correctly Andi Kleen
2011-07-27 21:48 ` [PATCH] [13/99] USB: CP210x Add 4 Device IDs for AC-Services Devices Andi Kleen
2011-07-27 21:48 ` [PATCH] [14/99] USB: moto_modem: Add USB identifier for the Motorola VE240 Andi Kleen
2011-07-27 21:48 ` [PATCH] [15/99] USB: serial: ftdi_sio: adding support for TavIR STK500 Andi Kleen
2011-07-27 21:48 ` [PATCH] [16/99] USB: gamin_gps: Fix for data transfer problems in native Andi Kleen
2011-07-27 21:48 ` [PATCH] [17/99] usb/gadget: at91sam9g20 fix end point max packet size Andi Kleen
2011-07-27 21:48 ` [PATCH] [18/99] usb: gadget: rndis: don't test against req->length Andi Kleen
2011-07-27 21:48 ` [PATCH] [19/99] xhci: Fix full speed bInterval encoding Andi Kleen
2011-07-27 21:48 ` [PATCH] [20/99] OHCI: work around for nVidia shutdown problem Andi Kleen
2011-07-27 21:48 ` [PATCH] [21/99] OHCI: fix regression caused by nVidia shutdown workaround Andi Kleen
2011-07-27 21:48 ` [PATCH] [22/99] p54usb: add zoom 4410 usbid Andi Kleen
2011-07-27 21:48 ` [PATCH] [23/99] eCryptfs: Allow 2 scatterlist entries for encrypted Andi Kleen
2011-07-27 21:48 ` [PATCH] [24/99] UBIFS: fix a rare memory leak in ro to rw remounting path Andi Kleen
2011-07-27 21:48 ` [PATCH] [25/99] i8k: Avoid lahf in 64-bit code Andi Kleen
2011-07-27 21:48 ` [PATCH] [26/99] cpuidle: menu: fixed wrapping timers at 4.294 seconds Andi Kleen
2011-07-27 21:48 ` [PATCH] [27/99] dm table: reject devices without request fns Andi Kleen
2011-07-27 21:48 ` [PATCH] [28/99] atm: expose ATM device index in sysfs Andi Kleen
2011-07-27 21:48 ` [PATCH] [29/99] brd: limit 'max_part' module param to DISK_MAX_PARTS Andi Kleen
2011-07-27 21:48 ` [PATCH] [30/99] brd: handle on-demand devices correctly Andi Kleen
2011-07-27 21:48 ` [PATCH] [31/99] SUNRPC: Deal with the lack of a SYN_SENT sk->sk_state_change Andi Kleen
2011-07-27 21:48 ` [PATCH] [32/99] PCI: Add quirk for setting valid class for TI816X Endpoint Andi Kleen
2011-07-27 21:48 ` [PATCH] [33/99] xen mmu: fix a race window causing leave_mm BUG() Andi Kleen
2011-07-27 21:48 ` [PATCH] [34/99] UBIFS: fix shrinker object count reports Andi Kleen
2011-07-27 21:48 ` [PATCH] [35/99] UBIFS: fix memory leak on error path Andi Kleen
2011-07-27 21:48 ` Andi Kleen [this message]
2011-07-27 21:48 ` [PATCH] [37/99] block: export blk_{get,put}_queue() Andi Kleen
2011-07-27 21:48 ` [PATCH] [38/99] Fix oops caused by queue refcounting failure Andi Kleen
2011-07-27 21:48 ` [PATCH] [39/99] mm: fix ENOSPC returned by handle_mm_fault() Andi Kleen
2011-07-27 21:48 ` [PATCH] [40/99] PCI: Set PCIE maxpayload for card during hotplug insertion Andi Kleen
2011-07-27 21:48 ` [PATCH] [41/99] nl80211: fix check for valid SSID size in scan operations Andi Kleen
2011-07-27 21:48 ` [PATCH] [42/99] lockdep: Fix lock_is_held() on recursion Andi Kleen
2011-07-27 21:48 ` [PATCH] [43/99] drm/i915: Add a no lvds quirk for the Asus EeeBox PC EB1007 Andi Kleen
2011-07-27 21:48 ` [PATCH] [44/99] drm/radeon/kms: fix for radeon on systems >4GB without Andi Kleen
2011-07-27 21:48 ` [PATCH] [45/99] fat: Fix corrupt inode flags when remove ATTR_SYS flag Andi Kleen
2011-07-27 21:48 ` [PATCH] [46/99] xen: off by one errors in multicalls.c Andi Kleen
2011-07-27 21:48 ` [PATCH] [47/99] x86/amd-iommu: Fix 3 possible endless loops Andi Kleen
2011-07-27 21:48 ` [PATCH] [48/99] USB: cdc-acm: Adding second ACM channel support for Nokia E7 Andi Kleen
2011-07-27 21:48 ` [PATCH] [49/99] USB: core: Tolerate protocol stall during hub and port Andi Kleen
2011-07-27 21:48 ` [PATCH] [50/99] USB: serial: add another 4N-GALAXY.DE PID to ftdi_sio driver Andi Kleen
2011-07-27 21:48 ` [PATCH] [51/99] USB: xhci - fix interval calculation for FS isoc endpoints Andi Kleen
2011-07-27 21:48 ` [PATCH] [52/99] ALSA: hda: Fix quirk for Dell Inspiron 910 Andi Kleen
2011-07-27 21:48 ` [PATCH] [53/99] oprofile, dcookies: Fix possible circular locking dependency Andi Kleen
2011-07-27 21:48 ` [PATCH] [54/99] CPUFREQ: Remove cpufreq_stats sysfs entries on module unload Andi Kleen
2011-07-27 21:48 ` [PATCH] [55/99] md: check ->hot_remove_disk when removing disk Andi Kleen
2011-07-27 21:48 ` [PATCH] [56/99] md/raid5: fix raid5_set_bi_hw_segments Andi Kleen
2011-07-27 21:48 ` [PATCH] [57/99] exec: delay address limit change until point of no return Andi Kleen
2011-07-27 21:48 ` [PATCH] [58/99] netfilter: IPv6: initialize TOS field in REJECT target module Andi Kleen
2011-07-27 21:48 ` [PATCH] [59/99] netfilter: IPv6: fix DSCP mangle code Andi Kleen
2011-07-28 1:51 ` Fernando Luis Vazquez Cao
2011-07-28 1:53 ` [STABLE] [PATCH] IGMP snooping: set mrouters_only flag for IPv4 traffic properly Fernando Luis Vazquez Cao
2011-07-28 1:54 ` [STABLE][PATCH] IGMP snooping: set mrouters_only flag for IPv6 " Fernando Luis Vazquez Cao
2011-07-28 23:54 ` [PATCH] [59/99] netfilter: IPv6: fix DSCP mangle code Andi Kleen
2011-07-27 21:48 ` [PATCH] [60/99] xen: events: do not unmask event channels on resume Andi Kleen
2011-07-27 21:49 ` [PATCH] [61/99] genirq: Add IRQF_FORCE_RESUME Andi Kleen
2011-07-27 21:49 ` [PATCH] [62/99] xen: Use IRQF_FORCE_RESUME Andi Kleen
2011-07-27 21:49 ` [PATCH] [63/99] time: Compensate for rounding on odd-frequency clocksources Andi Kleen
2011-07-27 21:49 ` [PATCH] [64/99] Revert "iwlagn: Support new 5000 microcode." Andi Kleen
2011-07-28 8:24 ` Stanislaw Gruszka
2011-07-28 13:45 ` Guy, Wey-Yi
2011-07-28 23:50 ` Andi Kleen
2011-07-28 17:32 ` Andi Kleen
2011-07-29 10:45 ` Stanislaw Gruszka
2011-07-27 21:49 ` [PATCH] [65/99] ksm: fix NULL pointer dereference in scan_get_next_rmap_item() Andi Kleen
2011-07-27 21:49 ` [PATCH] [66/99] migrate: don't account swapcache as shmem Andi Kleen
2011-07-27 21:49 ` [PATCH] [67/99] xen: partially revert "xen: set max_pfn_mapped to the last pfn mapped" Andi Kleen
2011-07-27 21:49 ` [PATCH] [68/99] clocksource: Make watchdog robust vs. interruption Andi Kleen
2011-07-27 21:49 ` [PATCH] [69/99] TTY: ldisc, do not close until there are readers Andi Kleen
2011-07-28 13:29 ` Jiri Slaby
2011-07-27 21:49 ` [PATCH] [70/99] xhci: Reject double add of active endpoints Andi Kleen
2011-07-27 21:49 ` [PATCH] [71/99] PM: Free memory bitmaps if opening /dev/snapshot fails Andi Kleen
2011-07-27 21:49 ` [PATCH] [72/99] ath5k: fix memory leak when fewer than N_PD_CURVES are in use Andi Kleen
2011-07-27 21:49 ` [PATCH] [73/99] mm: fix negative commitlimit when gigantic hugepages are allocated Andi Kleen
2011-07-27 21:49 ` [PATCH] [74/99] uvcvideo: Remove buffers from the queues when freeing Andi Kleen
2011-07-27 21:49 ` [PATCH] [75/99] watchdog: mtx1-wdt: request gpio before using it Andi Kleen
2011-07-27 21:49 ` [PATCH] [76/99] debugobjects: Fix boot crash when kmemleak and debugobjects enabled Andi Kleen
2011-07-27 21:49 ` [PATCH] [77/99] cfq-iosched: fix locking around ioc->ioc_data assignment Andi Kleen
2011-07-27 21:49 ` [PATCH] [78/99] cfq-iosched: fix a rcu warning Andi Kleen
2011-07-27 21:49 ` [PATCH] [79/99] i2c-taos-evm: Fix log messages Andi Kleen
2011-07-27 21:49 ` [PATCH] [80/99] md: avoid endless recovery loop when waiting for fail device to complete Andi Kleen
2011-07-27 21:49 ` [PATCH] [81/99] SUNRPC: Ensure the RPC client only quits on fatal signals Andi Kleen
2011-07-27 21:49 ` [PATCH] [82/99] 6pack,mkiss: fix lock inconsistency Andi Kleen
2011-07-27 21:49 ` [PATCH] [83/99] taskstats: don't allow duplicate entries in listener mode Andi Kleen
2011-07-27 21:49 ` [PATCH] [84/99] USB: don't let errors prevent system sleep Andi Kleen
2011-07-27 21:49 ` [PATCH] [85/99] USB: don't let the hub driver " Andi Kleen
2011-07-27 21:49 ` [PATCH] [86/99] uml: fix CONFIG_STATIC_LINK=y build failure with newer glibc Andi Kleen
2011-07-27 21:49 ` [PATCH] [87/99] inet_diag: fix inet_diag_bc_audit() Andi Kleen
2011-07-27 21:49 ` [PATCH] [88/99] PM / Hibernate: Fix free_unnecessary_pages() Andi Kleen
2011-07-27 21:49 ` [PATCH] [89/99] bug.h: Add WARN_RATELIMIT Andi Kleen
2011-07-27 21:49 ` [PATCH] [90/99] net: filter: Use WARN_RATELIMIT Andi Kleen
2011-07-27 21:49 ` [PATCH] [91/99] af_packet: prevent information leak Andi Kleen
2011-07-27 21:49 ` [PATCH] [92/99] net/ipv4: Check for mistakenly passed in non-IPv4 address Andi Kleen
2011-07-27 21:49 ` [PATCH] [93/99] ipv6/udp: Use the correct variable to determine non-blocking condition Andi Kleen
2011-07-27 21:49 ` [PATCH] [94/99] udp/recvmsg: Clear MSG_TRUNC flag when starting over for a new packet Andi Kleen
2011-07-27 21:49 ` [PATCH] [95/99] mm: prevent concurrent unmap_mapping_range() on the same Andi Kleen
2011-07-27 21:49 ` [PATCH] [96/99] proc: restrict access to /proc/PID/io Andi Kleen
2011-07-27 21:49 ` [PATCH] [97/99] alpha: fix several security issues Andi Kleen
2011-07-27 21:49 ` [PATCH] [98/99] x86: Make Dell Latitude E5420 use reboot=pci Andi Kleen
2011-07-27 21:49 ` [PATCH] [99/99] x86: Make Dell Latitude E6420 " Andi Kleen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110727214834.EEF092403FF@tassilo.jf.intel.com \
--to=andi@firstfloor.org \
--cc=Laurent.Vivier@bull.net \
--cc=Paul.Clements@steeleye.com \
--cc=ak@linux.intel.com \
--cc=gregkh@suse.de \
--cc=jaxboe@fusionio.com \
--cc=linux-kernel@vger.kernel.org \
--cc=namhyung@gmail.com \
--cc=stable@kernel.org \
--cc=tim.bird@am.sony.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome