From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Mikulas Patocka <mpatocka@redhat.com>,
Mike Snitzer <snitzer@redhat.com>
Subject: [PATCH 4.19 24/49] dm snapshot: fix crash with transient storage and zero chunk size
Date: Mon, 24 May 2021 17:25:35 +0200 [thread overview]
Message-ID: <20210524152325.158126942@linuxfoundation.org> (raw)
In-Reply-To: <20210524152324.382084875@linuxfoundation.org>
From: Mikulas Patocka <mpatocka@redhat.com>
commit c699a0db2d62e3bbb7f0bf35c87edbc8d23e3062 upstream.
The following commands will crash the kernel:
modprobe brd rd_size=1048576
dmsetup create o --table "0 `blockdev --getsize /dev/ram0` snapshot-origin /dev/ram0"
dmsetup create s --table "0 `blockdev --getsize /dev/ram0` snapshot /dev/ram0 /dev/ram1 N 0"
The reason is that when we test for zero chunk size, we jump to the label
bad_read_metadata without setting the "r" variable. The function
snapshot_ctr destroys all the structures and then exits with "r == 0". The
kernel then crashes because it falsely believes that snapshot_ctr
succeeded.
In order to fix the bug, we set the variable "r" to -EINVAL.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-snap.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -1285,6 +1285,7 @@ static int snapshot_ctr(struct dm_target
if (!s->store->chunk_size) {
ti->error = "Chunk size not set";
+ r = -EINVAL;
goto bad_read_metadata;
}
next prev parent reply other threads:[~2021-05-24 15:47 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-24 15:25 [PATCH 4.19 00/49] 4.19.192-rc1 review Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 01/49] firmware: arm_scpi: Prevent the ternary sign expansion bug Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 02/49] openrisc: Fix a memory leak Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 03/49] RDMA/rxe: Clear all QP fields if creation failed Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 04/49] scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 05/49] RDMA/mlx5: Recover from fatal event in dual port mode Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 06/49] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 07/49] ptrace: make ptrace() fail if the tracee changed its pid unexpectedly Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 08/49] nvmet: seset ns->file when open fails Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 09/49] locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 10/49] cifs: fix memory leak in smb2_copychunk_range Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 11/49] ALSA: dice: fix stream format for TC Electronic Konnekt Live at high sampling transfer frequency Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 12/49] ALSA: line6: Fix racy initialization of LINE6 MIDI Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 13/49] ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26 Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 14/49] ALSA: usb-audio: Validate MS endpoint descriptors Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 15/49] ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 16/49] Revert "ALSA: sb8: add a check for request_region" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 17/49] ALSA: hda/realtek: reset eapd coeff to default value for alc287 Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 18/49] ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293 Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 19/49] Revert "rapidio: fix a NULL pointer dereference when create_workqueue() fails" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 20/49] rapidio: handle create_workqueue() failure Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 21/49] Revert "serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 22/49] xen-pciback: reconfigure also from backend watch handler Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 23/49] dm snapshot: fix a crash when an origin has no snapshots Greg Kroah-Hartman
2021-05-24 15:25 ` Greg Kroah-Hartman [this message]
2021-05-24 15:25 ` [PATCH 4.19 25/49] Revert "video: hgafb: fix potential NULL pointer dereference" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 26/49] Revert "net: stmicro: fix a missing check of clk_prepare" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 27/49] Revert "leds: lp5523: fix a missing check of return value of lp55xx_read" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 28/49] Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 29/49] Revert "video: imsttfb: fix potential NULL pointer dereferences" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 30/49] Revert "ecryptfs: replace BUG_ON with error handling code" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 31/49] Revert "scsi: ufs: fix a missing check of devm_reset_control_get" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 32/49] Revert "gdrom: fix a memory leak bug" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 33/49] cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 34/49] cdrom: gdrom: initialize global variable at init time Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 35/49] Revert "media: rcar_drif: fix a memory disclosure" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 36/49] Revert "rtlwifi: fix a potential NULL pointer dereference" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 37/49] Revert "qlcnic: Avoid " Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 38/49] Revert "niu: fix missing checks of niu_pci_eeprom_read" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 39/49] ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 40/49] net: stmicro: handle clk_prepare() failure during init Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 41/49] scsi: ufs: handle cleanup correctly on devm_reset_control_get error Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 42/49] net: rtlwifi: properly check for alloc_workqueue() failure Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 43/49] leds: lp5523: check return value of lp5xx_read and jump to cleanup code Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 44/49] qlcnic: Add null check after calling netdev_alloc_skb Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 45/49] video: hgafb: fix potential NULL pointer dereference Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 46/49] vgacon: Record video mode changes with VT_RESIZEX Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 47/49] vt: Fix character height handling " Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 48/49] tty: vt: always invoke vc->vc_sw->con_resize callback Greg Kroah-Hartman
2021-05-24 15:26 ` [PATCH 4.19 49/49] x86/Xen: swap NX determination and GDT setup on BSP Greg Kroah-Hartman
2021-05-25 5:11 ` Juergen Gross
2021-05-25 6:55 ` Greg Kroah-Hartman
2021-05-24 22:05 ` [PATCH 4.19 00/49] 4.19.192-rc1 review Shuah Khan
2021-05-25 8:14 ` Naresh Kamboju
2021-05-25 14:20 ` Sudip Mukherjee
2021-05-25 14:32 ` Pavel Machek
2021-05-25 21:23 ` Guenter Roeck
2021-05-26 1:02 ` Samuel Zou
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210524152325.158126942@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mpatocka@redhat.com \
--cc=snitzer@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).