linux-stable/drivers/md
Namhyung Kim e97726577a md: check ->hot_remove_disk when removing disk
commit 01393f3d58 upstream.

Check pers->hot_remove_disk instead of pers->hot_add_disk in slot_store()
during disk removal. The linear personality only has ->hot_add_disk and
no ->hot_remove_disk, so that removing disk in the array resulted to
following kernel bug:

$ sudo mdadm --create /dev/md0 --level=linear --raid-devices=4 /dev/loop[0-3]
$ echo none | sudo tee /sys/block/md0/md/dev-loop2/slot
 BUG: unable to handle kernel NULL pointer dereference at           (null)
 IP: [<          (null)>]           (null)
 PGD c9f5d067 PUD 8575a067 PMD 0
 Oops: 0010 [#1] SMP
 CPU 2
 Modules linked in: linear loop bridge stp llc kvm_intel kvm asus_atk0110 sr_mod cdrom sg

 Pid: 10450, comm: tee Not tainted 3.0.0-rc1-leonard+ #173 System manufacturer System Product Name/P5G41TD-M PRO
 RIP: 0010:[<0000000000000000>]  [<          (null)>]           (null)
 RSP: 0018:ffff880085757df0  EFLAGS: 00010282
 RAX: ffffffffa00168e0 RBX: ffff8800d1431800 RCX: 000000000000006e
 RDX: 0000000000000001 RSI: 0000000000000002 RDI: ffff88008543c000
 RBP: ffff880085757e48 R08: 0000000000000002 R09: 000000000000000a
 R10: 0000000000000000 R11: ffff88008543c2e0 R12: 00000000ffffffff
 R13: ffff8800b4641000 R14: 0000000000000005 R15: 0000000000000000
 FS:  00007fe8c9e05700(0000) GS:ffff88011fa00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 0000000000000000 CR3: 00000000b4502000 CR4: 00000000000406e0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
 Process tee (pid: 10450, threadinfo ffff880085756000, task ffff8800c9f08000)
 Stack:
  ffffffff8138496a ffff8800b4641000 ffff88008543c268 0000000000000000
  ffff8800b4641000 ffff88008543c000 ffff8800d1431868 ffffffff81a78a90
  ffff8800b4641000 ffff88008543c000 ffff8800d1431800 ffff880085757e98
 Call Trace:
  [<ffffffff8138496a>] ? slot_store+0xaa/0x265
  [<ffffffff81384bae>] rdev_attr_store+0x89/0xa8
  [<ffffffff8115a96a>] sysfs_write_file+0x108/0x144
  [<ffffffff81106b87>] vfs_write+0xb1/0x10d
  [<ffffffff8106e6c0>] ? trace_hardirqs_on_caller+0x111/0x135
  [<ffffffff81106cac>] sys_write+0x4d/0x77
  [<ffffffff814fe702>] system_call_fastpath+0x16/0x1b
 Code:  Bad RIP value.
 RIP  [<          (null)>]           (null)
  RSP <ffff880085757df0>
 CR2: 0000000000000000
 ---[ end trace ba5fc64319a826fb ]---

Signed-off-by: Namhyung Kim <namhyung@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
2012-02-11 15:37:30 +01:00
..
raid6test md: raid6: clean up the style of raid6test/test.c 2008-02-06 10:41:18 -08:00
.gitignore gitignore: misc files 2006-01-01 22:21:50 +01:00
bitmap.c md: fix some (more) errors with bitmaps on devices larger than 2TB. 2009-05-19 22:20:05 -07:00
dm-bio-list.h dm: bio_list macro renaming 2007-10-20 02:01:11 +01:00
dm-bio-record.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
dm-crypt.c dm crypt: fix kcryptd_async_done parameter 2009-03-23 14:59:59 -07:00
dm-delay.c dm: bio_list macro renaming 2007-10-20 02:01:11 +01:00
dm-exception-store.c dm: move include files 2008-04-25 13:26:55 +01:00
dm-io.c dm io: respect BIO_MAX_PAGES limit 2009-03-23 15:00:00 -07:00
dm-ioctl.c dm ioctl: validate name length when renaming 2009-03-23 15:00:00 -07:00
dm-kcopyd.c dm kcopyd: avoid queue shuffle 2008-10-25 14:32:39 -07:00
dm-linear.c dm: linear add merge 2008-07-21 12:00:38 +01:00
dm-log.c dm log: fix dm_io_client leak on error paths 2009-01-18 10:35:26 -08:00
dm-mpath.c dm mpath: validate table argument count 2009-07-02 16:32:08 -07:00
dm-mpath.h [SCSI] scsi_dh: Remove hardware handler infrastructure from dm 2008-06-05 09:23:42 -05:00
dm-path-selector.c dm: use kzalloc 2007-10-20 02:01:07 +01:00
dm-path-selector.h [PATCH] struct path: rename DM's struct path 2006-12-08 08:28:40 -08:00
dm-raid1.c dm raid1: fail writes if errors are not handled and log fails 2011-04-30 16:53:04 +02:00
dm-round-robin.c dm: remove duplicate module name from error msgs 2007-07-12 15:01:08 -07:00
dm-snap.c dm snapshot: fix primary_pe race 2008-10-25 14:32:39 -07:00
dm-snap.h dm snapshot: use per device mempools 2008-07-21 12:00:35 +01:00
dm-stripe.c dm: stripe enhanced status return 2008-02-08 02:11:24 +00:00
dm-table.c [PATCH] switch mtd and dm-table to lookup_bdev() 2008-08-01 11:25:31 -04:00
dm-target.c dm: use kzalloc 2007-10-20 02:01:07 +01:00
dm-uevent.c md: replace remaining __FUNCTION__ occurrences 2008-04-28 08:58:42 -07:00
dm-uevent.h dm: uevent generate events 2007-10-20 02:01:26 +01:00
dm-zero.c Drop 'size' argument from bio_endio and bi_end_io 2007-10-10 09:25:57 +02:00
dm.c Revert "dm: sysfs skip output when device is being destroyed" 2009-07-19 20:43:27 -07:00
dm.h dm log: make dm_dirty_log init and exit static 2008-07-21 12:00:27 +01:00
faulty.c md: Make mddev->array_size sector-based. 2008-07-21 17:05:22 +10:00
Kconfig [SCSI] scsi_dh: fix kconfig related build errors 2008-07-15 09:16:43 -05:00
linear.c md: linear: Fix a division by zero bug for very small arrays. 2008-11-13 09:55:57 -08:00
Makefile [SCSI] scsi_dh: Remove hardware handler infrastructure from dm 2008-06-05 09:23:42 -05:00
md.c md: check ->hot_remove_disk when removing disk 2012-02-11 15:37:30 +01:00
mktables.c md: raid6: Fix mktable.c 2008-02-06 10:41:18 -08:00
multipath.c md: Make mddev->array_size sector-based. 2008-07-21 17:05:22 +10:00
raid0.c Merge branch 'for-linus' of git://neil.brown.name/md 2008-07-21 10:29:12 -07:00
raid1.c md: Fix read balancing in RAID1 and RAID10 on drives > 2TB 2010-07-05 11:08:43 -07:00
raid5.c md/raid5: add missing call to schedule() after prepare_to_wait() 2009-07-02 16:31:53 -07:00
raid6.h [PATCH] RAID6 Altivec fix 2005-09-17 11:49:58 -07:00
raid6algos.c drivers/md: use time_before, time_before_eq, etc 2008-04-28 08:58:42 -07:00
raid6altivec.uc [PATCH] RAID6 Altivec fix 2005-09-17 11:49:58 -07:00
raid6int.uc Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
raid6mmx.c x86 merge fallout: uml 2007-10-29 07:41:32 -07:00
raid6recov.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
raid6sse1.c x86 merge fallout: uml 2007-10-29 07:41:32 -07:00
raid6sse2.c x86 merge fallout: uml 2007-10-29 07:41:32 -07:00
raid6x86.h x86 merge fallout: uml 2007-10-29 07:41:32 -07:00
raid10.c md/raid10: fix deadlock with unaligned read during resync 2010-08-13 13:50:36 -07:00
unroll.pl Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00