All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>, Joe Thornber <ejt@redhat.com>,
	dm-devel@redhat.com, agk@redhat.com,
	Mike Snitzer <snitzer@redhat.com>
Subject: [dm-devel] [PATCH AUTOSEL 4.4 25/29] dm btree: add a defensive bounds check to insert_at()
Date: Mon, 17 Jan 2022 22:08:18 -0500	[thread overview]
Message-ID: <20220118030822.1955469-25-sashal@kernel.org> (raw)
In-Reply-To: <20220118030822.1955469-1-sashal@kernel.org>

From: Joe Thornber <ejt@redhat.com>

[ Upstream commit 85bca3c05b6cca31625437eedf2060e846c4bbad ]

Corrupt metadata could trigger an out of bounds write.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/persistent-data/dm-btree.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index fa9039a53ae5c..23b1d22f693c1 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -83,14 +83,16 @@ void inc_children(struct dm_transaction_manager *tm, struct btree_node *n,
 }
 
 static int insert_at(size_t value_size, struct btree_node *node, unsigned index,
-		      uint64_t key, void *value)
-		      __dm_written_to_disk(value)
+		     uint64_t key, void *value)
+	__dm_written_to_disk(value)
 {
 	uint32_t nr_entries = le32_to_cpu(node->header.nr_entries);
+	uint32_t max_entries = le32_to_cpu(node->header.max_entries);
 	__le64 key_le = cpu_to_le64(key);
 
 	if (index > nr_entries ||
-	    index >= le32_to_cpu(node->header.max_entries)) {
+	    index >= max_entries ||
+	    nr_entries >= max_entries) {
 		DMERR("too many entries in btree node for insert");
 		__dm_unbless_for_disk(value);
 		return -ENOMEM;
-- 
2.34.1


--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel


WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Joe Thornber <ejt@redhat.com>, Mike Snitzer <snitzer@redhat.com>,
	Sasha Levin <sashal@kernel.org>,
	agk@redhat.com, dm-devel@redhat.com
Subject: [PATCH AUTOSEL 4.4 25/29] dm btree: add a defensive bounds check to insert_at()
Date: Mon, 17 Jan 2022 22:08:18 -0500	[thread overview]
Message-ID: <20220118030822.1955469-25-sashal@kernel.org> (raw)
In-Reply-To: <20220118030822.1955469-1-sashal@kernel.org>

From: Joe Thornber <ejt@redhat.com>

[ Upstream commit 85bca3c05b6cca31625437eedf2060e846c4bbad ]

Corrupt metadata could trigger an out of bounds write.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/persistent-data/dm-btree.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index fa9039a53ae5c..23b1d22f693c1 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -83,14 +83,16 @@ void inc_children(struct dm_transaction_manager *tm, struct btree_node *n,
 }
 
 static int insert_at(size_t value_size, struct btree_node *node, unsigned index,
-		      uint64_t key, void *value)
-		      __dm_written_to_disk(value)
+		     uint64_t key, void *value)
+	__dm_written_to_disk(value)
 {
 	uint32_t nr_entries = le32_to_cpu(node->header.nr_entries);
+	uint32_t max_entries = le32_to_cpu(node->header.max_entries);
 	__le64 key_le = cpu_to_le64(key);
 
 	if (index > nr_entries ||
-	    index >= le32_to_cpu(node->header.max_entries)) {
+	    index >= max_entries ||
+	    nr_entries >= max_entries) {
 		DMERR("too many entries in btree node for insert");
 		__dm_unbless_for_disk(value);
 		return -ENOMEM;
-- 
2.34.1


  parent reply	other threads:[~2022-01-18  3:15 UTC|newest]

Thread overview: 45+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-01-18  3:07 [PATCH AUTOSEL 4.4 01/29] Bluetooth: Fix debugfs entry leak in hci_register_dev() Sasha Levin
2022-01-18  3:07 ` [PATCH AUTOSEL 4.4 02/29] fs: dlm: filter user dlm messages for kernel locks Sasha Levin
2022-01-18  3:07   ` [Cluster-devel] " Sasha Levin
2022-01-18  3:07 ` [PATCH AUTOSEL 4.4 03/29] ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply Sasha Levin
2022-01-18  3:07 ` [PATCH AUTOSEL 4.4 04/29] usb: gadget: f_fs: Use stream_open() for endpoint files Sasha Levin
2022-01-18  3:07 ` [PATCH AUTOSEL 4.4 05/29] media: b2c2: Add missing check in flexcop_pci_isr: Sasha Levin
2022-01-18  3:07 ` [PATCH AUTOSEL 4.4 06/29] ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART Sasha Levin
2022-01-18  3:07   ` Sasha Levin
2022-01-20 10:08   ` Pavel Machek
2022-01-20 10:08     ` Pavel Machek
2022-01-22 19:27     ` Sasha Levin
2022-01-22 19:27       ` Sasha Levin
2022-01-22 20:45       ` Pavel Machek
2022-01-22 20:45         ` Pavel Machek
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 07/29] HSI: core: Fix return freed object in hsi_new_client Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 08/29] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 09/29] floppy: Add max size check for user space request Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 10/29] media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 11/29] media: m920x: don't use stack on USB reads Sasha Levin
2022-01-20 10:26   ` Pavel Machek
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 12/29] iwlwifi: mvm: synchronize with FW after multicast commands Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 13/29] net: Enable neighbor sysctls that is save for userns root Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 14/29] net: bonding: debug: avoid printing debug logs when bond is not notifying peers Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 15/29] media: igorplugusb: receiver overflow should be reported Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 16/29] media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 17/29] usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 18/29] ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 19/29] um: registers: Rename function names to avoid conflicts and build problems Sasha Levin
2022-01-18  3:08   ` Sasha Levin
2022-01-18  8:04   ` Johannes Berg
2022-01-18  8:04     ` Johannes Berg
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 20/29] ACPICA: Utilities: Avoid deleting the same object twice in a row Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 21/29] ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 22/29] btrfs: remove BUG_ON() in find_parent_nodes() Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 23/29] btrfs: remove BUG_ON(!eie) in find_parent_nodes Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 24/29] net: mdio: Demote probed message to debug print Sasha Levin
2022-01-18  3:08 ` Sasha Levin [this message]
2022-01-18  3:08   ` [PATCH AUTOSEL 4.4 25/29] dm btree: add a defensive bounds check to insert_at() Sasha Levin
2022-01-18  3:08 ` [dm-devel] [PATCH AUTOSEL 4.4 26/29] dm space map common: add bounds check to sm_ll_lookup_bitmap() Sasha Levin
2022-01-18  3:08   ` Sasha Levin
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 27/29] serial: pl010: Drop CR register reset on set_termios Sasha Levin
2022-01-18 16:43   ` Lukas Wunner
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 28/29] serial: core: Keep mctrl register state and cached copy in sync Sasha Levin
2022-01-18  6:03   ` Greg Kroah-Hartman
2022-01-18  3:08 ` [PATCH AUTOSEL 4.4 29/29] parisc: Avoid calling faulthandler_disabled() twice Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220118030822.1955469-25-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=agk@redhat.com \
    --cc=dm-devel@redhat.com \
    --cc=ejt@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=snitzer@redhat.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.