From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>, Joe Thornber <ejt@redhat.com>,
dm-devel@redhat.com, agk@redhat.com,
Mike Snitzer <snitzer@redhat.com>
Subject: [dm-devel] [PATCH AUTOSEL 4.4 26/29] dm space map common: add bounds check to sm_ll_lookup_bitmap()
Date: Mon, 17 Jan 2022 22:08:19 -0500 [thread overview]
Message-ID: <20220118030822.1955469-26-sashal@kernel.org> (raw)
In-Reply-To: <20220118030822.1955469-1-sashal@kernel.org>
From: Joe Thornber <ejt@redhat.com>
[ Upstream commit cba23ac158db7f3cd48a923d6861bee2eb7a2978 ]
Corrupted metadata could warrant returning error from sm_ll_lookup_bitmap().
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/persistent-data/dm-space-map-common.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c
index ca09ad2a639c4..6fa4a68e78b0d 100644
--- a/drivers/md/persistent-data/dm-space-map-common.c
+++ b/drivers/md/persistent-data/dm-space-map-common.c
@@ -279,6 +279,11 @@ int sm_ll_lookup_bitmap(struct ll_disk *ll, dm_block_t b, uint32_t *result)
struct disk_index_entry ie_disk;
struct dm_block *blk;
+ if (b >= ll->nr_blocks) {
+ DMERR_LIMIT("metadata block out of bounds");
+ return -EINVAL;
+ }
+
b = do_div(index, ll->entries_per_block);
r = ll->load_ie(ll, index, &ie_disk);
if (r < 0)
--
2.34.1
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Joe Thornber <ejt@redhat.com>, Mike Snitzer <snitzer@redhat.com>,
Sasha Levin <sashal@kernel.org>,
agk@redhat.com, dm-devel@redhat.com
Subject: [PATCH AUTOSEL 4.4 26/29] dm space map common: add bounds check to sm_ll_lookup_bitmap()
Date: Mon, 17 Jan 2022 22:08:19 -0500 [thread overview]
Message-ID: <20220118030822.1955469-26-sashal@kernel.org> (raw)
In-Reply-To: <20220118030822.1955469-1-sashal@kernel.org>
From: Joe Thornber <ejt@redhat.com>
[ Upstream commit cba23ac158db7f3cd48a923d6861bee2eb7a2978 ]
Corrupted metadata could warrant returning error from sm_ll_lookup_bitmap().
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/persistent-data/dm-space-map-common.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c
index ca09ad2a639c4..6fa4a68e78b0d 100644
--- a/drivers/md/persistent-data/dm-space-map-common.c
+++ b/drivers/md/persistent-data/dm-space-map-common.c
@@ -279,6 +279,11 @@ int sm_ll_lookup_bitmap(struct ll_disk *ll, dm_block_t b, uint32_t *result)
struct disk_index_entry ie_disk;
struct dm_block *blk;
+ if (b >= ll->nr_blocks) {
+ DMERR_LIMIT("metadata block out of bounds");
+ return -EINVAL;
+ }
+
b = do_div(index, ll->entries_per_block);
r = ll->load_ie(ll, index, &ie_disk);
if (r < 0)
--
2.34.1
next prev parent reply other threads:[~2022-01-18 3:15 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-18 3:07 [PATCH AUTOSEL 4.4 01/29] Bluetooth: Fix debugfs entry leak in hci_register_dev() Sasha Levin
2022-01-18 3:07 ` [Cluster-devel] [PATCH AUTOSEL 4.4 02/29] fs: dlm: filter user dlm messages for kernel locks Sasha Levin
2022-01-18 3:07 ` Sasha Levin
2022-01-18 3:07 ` [PATCH AUTOSEL 4.4 03/29] ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply Sasha Levin
2022-01-18 3:07 ` [PATCH AUTOSEL 4.4 04/29] usb: gadget: f_fs: Use stream_open() for endpoint files Sasha Levin
2022-01-18 3:07 ` [PATCH AUTOSEL 4.4 05/29] media: b2c2: Add missing check in flexcop_pci_isr: Sasha Levin
2022-01-18 3:07 ` [PATCH AUTOSEL 4.4 06/29] ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART Sasha Levin
2022-01-18 3:07 ` Sasha Levin
2022-01-20 10:08 ` Pavel Machek
2022-01-20 10:08 ` Pavel Machek
2022-01-22 19:27 ` Sasha Levin
2022-01-22 19:27 ` Sasha Levin
2022-01-22 20:45 ` Pavel Machek
2022-01-22 20:45 ` Pavel Machek
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 07/29] HSI: core: Fix return freed object in hsi_new_client Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 08/29] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 09/29] floppy: Add max size check for user space request Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 10/29] media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 11/29] media: m920x: don't use stack on USB reads Sasha Levin
2022-01-20 10:26 ` Pavel Machek
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 12/29] iwlwifi: mvm: synchronize with FW after multicast commands Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 13/29] net: Enable neighbor sysctls that is save for userns root Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 14/29] net: bonding: debug: avoid printing debug logs when bond is not notifying peers Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 15/29] media: igorplugusb: receiver overflow should be reported Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 16/29] media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 17/29] usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 18/29] ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 19/29] um: registers: Rename function names to avoid conflicts and build problems Sasha Levin
2022-01-18 3:08 ` Sasha Levin
2022-01-18 8:04 ` Johannes Berg
2022-01-18 8:04 ` Johannes Berg
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 20/29] ACPICA: Utilities: Avoid deleting the same object twice in a row Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 21/29] ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 22/29] btrfs: remove BUG_ON() in find_parent_nodes() Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 23/29] btrfs: remove BUG_ON(!eie) in find_parent_nodes Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 24/29] net: mdio: Demote probed message to debug print Sasha Levin
2022-01-18 3:08 ` [dm-devel] [PATCH AUTOSEL 4.4 25/29] dm btree: add a defensive bounds check to insert_at() Sasha Levin
2022-01-18 3:08 ` Sasha Levin
2022-01-18 3:08 ` Sasha Levin [this message]
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 26/29] dm space map common: add bounds check to sm_ll_lookup_bitmap() Sasha Levin
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 27/29] serial: pl010: Drop CR register reset on set_termios Sasha Levin
2022-01-18 16:43 ` Lukas Wunner
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 28/29] serial: core: Keep mctrl register state and cached copy in sync Sasha Levin
2022-01-18 6:03 ` Greg Kroah-Hartman
2022-01-18 3:08 ` [PATCH AUTOSEL 4.4 29/29] parisc: Avoid calling faulthandler_disabled() twice Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220118030822.1955469-26-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=agk@redhat.com \
--cc=dm-devel@redhat.com \
--cc=ejt@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=snitzer@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.