* [PATCH stable] dm ioctl: fix out of bounds array access when no devices
@ 2021-05-19 7:41 ` Ard Biesheuvel
0 siblings, 0 replies; 6+ messages in thread
From: Ard Biesheuvel @ 2021-05-19 7:41 UTC (permalink / raw)
To: stable
Cc: snitzer, agk, dm-devel, Mikulas Patocka, Dan Carpenter, Ard Biesheuvel
From: Mikulas Patocka <mpatocka@redhat.com>
commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
If there are not any dm devices, we need to zero the "dev" argument in
the first structure dm_name_list. However, this can cause out of
bounds write, because the "needed" variable is zero and len may be
less than eight.
Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
too small to hold the "nl->dev" value.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
Please apply to 4.4.y and 4.9.y
drivers/md/dm-ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 836a2808c0c7..eb2659a12310 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -524,7 +524,7 @@ static int list_devices(struct dm_ioctl *param, size_t param_size)
* Grab our output buffer.
*/
nl = get_result_buffer(param, param_size, &len);
- if (len < needed) {
+ if (len < needed || len < sizeof(nl->dev)) {
param->flags |= DM_BUFFER_FULL_FLAG;
goto out;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [dm-devel] [PATCH stable] dm ioctl: fix out of bounds array access when no devices
@ 2021-05-19 7:41 ` Ard Biesheuvel
0 siblings, 0 replies; 6+ messages in thread
From: Ard Biesheuvel @ 2021-05-19 7:41 UTC (permalink / raw)
To: stable
Cc: snitzer, dm-devel, Mikulas Patocka, agk, Ard Biesheuvel, Dan Carpenter
From: Mikulas Patocka <mpatocka@redhat.com>
commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
If there are not any dm devices, we need to zero the "dev" argument in
the first structure dm_name_list. However, this can cause out of
bounds write, because the "needed" variable is zero and len may be
less than eight.
Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
too small to hold the "nl->dev" value.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
Please apply to 4.4.y and 4.9.y
drivers/md/dm-ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 836a2808c0c7..eb2659a12310 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -524,7 +524,7 @@ static int list_devices(struct dm_ioctl *param, size_t param_size)
* Grab our output buffer.
*/
nl = get_result_buffer(param, param_size, &len);
- if (len < needed) {
+ if (len < needed || len < sizeof(nl->dev)) {
param->flags |= DM_BUFFER_FULL_FLAG;
goto out;
}
--
2.20.1
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH stable] dm ioctl: fix out of bounds array access when no devices
2021-05-19 7:41 ` [dm-devel] " Ard Biesheuvel
@ 2021-05-19 14:56 ` Sasha Levin
-1 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2021-05-19 14:56 UTC (permalink / raw)
To: Ard Biesheuvel
Cc: stable, snitzer, agk, dm-devel, Mikulas Patocka, Dan Carpenter
On Wed, May 19, 2021 at 09:41:24AM +0200, Ard Biesheuvel wrote:
>From: Mikulas Patocka <mpatocka@redhat.com>
>
>commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
>
>If there are not any dm devices, we need to zero the "dev" argument in
>the first structure dm_name_list. However, this can cause out of
>bounds write, because the "needed" variable is zero and len may be
>less than eight.
>
>Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
>too small to hold the "nl->dev" value.
>
>Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
>Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>Cc: stable@vger.kernel.org
>Signed-off-by: Mike Snitzer <snitzer@redhat.com>
>Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
>---
>Please apply to 4.4.y and 4.9.y
We already carry this patch via the backport provided in
https://lore.kernel.org/stable/20210513094552.266451-1-nobuhiro1.iwamatsu@toshiba.co.jp/
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [dm-devel] [PATCH stable] dm ioctl: fix out of bounds array access when no devices
@ 2021-05-19 14:56 ` Sasha Levin
0 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2021-05-19 14:56 UTC (permalink / raw)
To: Ard Biesheuvel
Cc: snitzer, stable, dm-devel, Mikulas Patocka, agk, Dan Carpenter
On Wed, May 19, 2021 at 09:41:24AM +0200, Ard Biesheuvel wrote:
>From: Mikulas Patocka <mpatocka@redhat.com>
>
>commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
>
>If there are not any dm devices, we need to zero the "dev" argument in
>the first structure dm_name_list. However, this can cause out of
>bounds write, because the "needed" variable is zero and len may be
>less than eight.
>
>Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
>too small to hold the "nl->dev" value.
>
>Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
>Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>Cc: stable@vger.kernel.org
>Signed-off-by: Mike Snitzer <snitzer@redhat.com>
>Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
>---
>Please apply to 4.4.y and 4.9.y
We already carry this patch via the backport provided in
https://lore.kernel.org/stable/20210513094552.266451-1-nobuhiro1.iwamatsu@toshiba.co.jp/
--
Thanks,
Sasha
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH stable] dm ioctl: fix out of bounds array access when no devices
2021-05-19 14:56 ` [dm-devel] " Sasha Levin
@ 2021-05-19 15:06 ` Ard Biesheuvel
-1 siblings, 0 replies; 6+ messages in thread
From: Ard Biesheuvel @ 2021-05-19 15:06 UTC (permalink / raw)
To: Sasha Levin
Cc: # 3.4.x, Mike Snitzer, agk, dm-devel, Mikulas Patocka, Dan Carpenter
On Wed, 19 May 2021 at 16:56, Sasha Levin <sashal@kernel.org> wrote:
>
> On Wed, May 19, 2021 at 09:41:24AM +0200, Ard Biesheuvel wrote:
> >From: Mikulas Patocka <mpatocka@redhat.com>
> >
> >commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
> >
> >If there are not any dm devices, we need to zero the "dev" argument in
> >the first structure dm_name_list. However, this can cause out of
> >bounds write, because the "needed" variable is zero and len may be
> >less than eight.
> >
> >Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
> >too small to hold the "nl->dev" value.
> >
> >Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> >Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> >Cc: stable@vger.kernel.org
> >Signed-off-by: Mike Snitzer <snitzer@redhat.com>
> >Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> >---
> >Please apply to 4.4.y and 4.9.y
>
> We already carry this patch via the backport provided in
> https://lore.kernel.org/stable/20210513094552.266451-1-nobuhiro1.iwamatsu@toshiba.co.jp/
>
Excellent, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [dm-devel] [PATCH stable] dm ioctl: fix out of bounds array access when no devices
@ 2021-05-19 15:06 ` Ard Biesheuvel
0 siblings, 0 replies; 6+ messages in thread
From: Ard Biesheuvel @ 2021-05-19 15:06 UTC (permalink / raw)
To: Sasha Levin
Cc: Mike Snitzer, # 3.4.x, dm-devel, Mikulas Patocka, agk, Dan Carpenter
On Wed, 19 May 2021 at 16:56, Sasha Levin <sashal@kernel.org> wrote:
>
> On Wed, May 19, 2021 at 09:41:24AM +0200, Ard Biesheuvel wrote:
> >From: Mikulas Patocka <mpatocka@redhat.com>
> >
> >commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
> >
> >If there are not any dm devices, we need to zero the "dev" argument in
> >the first structure dm_name_list. However, this can cause out of
> >bounds write, because the "needed" variable is zero and len may be
> >less than eight.
> >
> >Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
> >too small to hold the "nl->dev" value.
> >
> >Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> >Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> >Cc: stable@vger.kernel.org
> >Signed-off-by: Mike Snitzer <snitzer@redhat.com>
> >Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> >---
> >Please apply to 4.4.y and 4.9.y
>
> We already carry this patch via the backport provided in
> https://lore.kernel.org/stable/20210513094552.266451-1-nobuhiro1.iwamatsu@toshiba.co.jp/
>
Excellent, thanks.
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-05-19 15:06 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-19 7:41 [PATCH stable] dm ioctl: fix out of bounds array access when no devices Ard Biesheuvel
2021-05-19 7:41 ` [dm-devel] " Ard Biesheuvel
2021-05-19 14:56 ` Sasha Levin
2021-05-19 14:56 ` [dm-devel] " Sasha Levin
2021-05-19 15:06 ` Ard Biesheuvel
2021-05-19 15:06 ` [dm-devel] " Ard Biesheuvel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.