kernel/linux.git/drivers/md/dm-raid1.c, branch v6.6.141

dm mirror: fix integer overflow in create_dirty_log()

2026-05-17T15:13:33+00:00

commit 4c788c6f921b22f9b6c3f316c4a071c05683e7de upstream. The argument count calculation in create_dirty_log() performs `*args_used = 2 + param_count` before validating against argc. When a user provides a param_count close to UINT_MAX via the device mapper table string, this unsigned addition wraps around to a small value, causing the subsequent `argc < *args_used` check to be bypassed. The overflowed param_count is then passed as argc to dm_dirty_log_create(), where it can cause out-of-bounds reads on the argv array. Fix by comparing param_count against argc - 2 before performing the addition, following the same pattern used by parse_features() in the same file. Since argc >= 2 is already guaranteed, the subtraction is safe. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Yuhao Jiang Signed-off-by: Junrui Luo Reviewed-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka Signed-off-by: Greg Kroah-Hartman

dm-mirror: fix a tiny race condition

2025-06-27T10:08:49+00:00

commit 829451beaed6165eb11d7a9fb4e28eb17f489980 upstream. There's a tiny race condition in dm-mirror. The functions queue_bio and write_callback grab a spinlock, add a bio to the list, drop the spinlock and wake up the mirrord thread that processes bios in the list. It may be possible that the mirrord thread processes the bio just after spin_unlock_irqrestore is called, before wakeup_mirrord. This spurious wake-up is normally harmless, however if the device mapper device is unloaded just after the bio was processed, it may be possible that wakeup_mirrord(ms) uses invalid "ms" pointer. Fix this bug by moving wakeup_mirrord inside the spinlock. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman

dm io: Support IO priority

2024-03-26T22:20:13+00:00

[ Upstream commit 6e5f0f6383b4896c7e9b943d84b136149d0f45e9 ] Some IO will dispatch from kworker with different io_context settings than the submitting task, we may need to specify a priority to avoid losing priority. Add IO priority parameter to dm_io() and update all callers. Co-developed-by: Yibin Ding Signed-off-by: Yibin Ding Signed-off-by: Hongyu Jin Reviewed-by: Eric Biggers Reviewed-by: Mikulas Patocka Signed-off-by: Mike Snitzer Stable-dep-of: b4d78cfeb304 ("dm-integrity: align the outgoing bio in integrity_recheck") Signed-off-by: Sasha Levin

dm: remove unnecessary (void*) conversions

2023-04-11T16:01:01+00:00

Pointer variables of void * type do not require type cast. Signed-off-by: Yu Zhe Signed-off-by: Mike Snitzer

dm mirror: add DMERR message if alloc_workqueue fails

2023-04-11T16:01:01+00:00

Signed-off-by: Yangtao Li Signed-off-by: Mike Snitzer

dm: push error reporting down to dm_register_target()

2023-04-11T16:01:01+00:00

Simplifies each DM target's init method by making dm_register_target() responsible for its error reporting (on behalf of targets). Signed-off-by: Yangtao Li Signed-off-by: Mike Snitzer

dm: update targets using system workqueues to use a local workqueue

2023-02-14T19:23:08+00:00

Flushing system-wide workqueues is dangerous and will be forbidden. Use a local workqueue in dm-mpath.c, dm-raid1.c, and dm-stripe.c. Link: https://lkml.kernel.org/r/49925af7-78a8-a3dd-bce6-cfc02e1a9236@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Signed-off-by: Mike Snitzer

dm: avoid split of quoted strings where possible

2023-02-14T19:23:07+00:00

Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer

dm: avoid spaces before function arguments or in favour of tabs

2023-02-14T19:23:06+00:00

Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer

dm: correct block comments format.

2023-02-14T19:23:06+00:00

Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer