All of lore.kernel.org
 help / color / mirror / Atom feed
From: Demi Marie Obenour <demi@invisiblethingslab.com>
To: "Jens Axboe" <axboe@kernel.dk>,
	"Roger Pau Monné" <roger.pau@citrix.com>,
	"Alasdair Kergon" <agk@redhat.com>,
	"Mike Snitzer" <snitzer@kernel.org>,
	dm-devel@redhat.com
Cc: "Marek Marczykowski-Górecki" <marmarek@invisiblethingslab.com>,
	stable@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-block@vger.kernel.org,
	"Demi Marie Obenour" <demi@invisiblethingslab.com>,
	xen-devel@lists.xenproject.org
Subject: [dm-devel] [PATCH v2 01/16] device-mapper: Check that target specs are sufficiently aligned
Date: Tue, 30 May 2023 16:31:01 -0400	[thread overview]
Message-ID: <20230530203116.2008-2-demi@invisiblethingslab.com> (raw)
In-Reply-To: <20230530203116.2008-1-demi@invisiblethingslab.com>

Otherwise subsequent code will dereference a misaligned
`struct dm_target_spec *`, which is undefined behavior.

Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
---
 drivers/md/dm-ioctl.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index cc77cf3d410921432eb0c62cdede7d55b9aa674a..34fa74c6a70db8aa67aaba3f6a2fc4f38ef736bc 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1394,6 +1394,13 @@ static inline fmode_t get_mode(struct dm_ioctl *param)
 static int next_target(struct dm_target_spec *last, uint32_t next, void *end,
 		       struct dm_target_spec **spec, char **target_params)
 {
+	static_assert(_Alignof(struct dm_target_spec) <= 8,
+		      "struct dm_target_spec has excessive alignment requirements");
+	if (next % 8) {
+		DMERR("Next target spec (offset %u) is not 8-byte aligned", next);
+		return -EINVAL;
+	}
+
 	*spec = (struct dm_target_spec *) ((unsigned char *) last + next);
 	*target_params = (char *) (*spec + 1);
 
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel


WARNING: multiple messages have this Message-ID (diff)
From: Demi Marie Obenour <demi@invisiblethingslab.com>
To: "Jens Axboe" <axboe@kernel.dk>,
	"Roger Pau Monné" <roger.pau@citrix.com>,
	"Alasdair Kergon" <agk@redhat.com>,
	"Mike Snitzer" <snitzer@kernel.org>,
	dm-devel@redhat.com
Cc: "Demi Marie Obenour" <demi@invisiblethingslab.com>,
	"Marek Marczykowski-Górecki" <marmarek@invisiblethingslab.com>,
	linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
	xen-devel@lists.xenproject.org, stable@vger.kernel.org
Subject: [PATCH v2 01/16] device-mapper: Check that target specs are sufficiently aligned
Date: Tue, 30 May 2023 16:31:01 -0400	[thread overview]
Message-ID: <20230530203116.2008-2-demi@invisiblethingslab.com> (raw)
In-Reply-To: <20230530203116.2008-1-demi@invisiblethingslab.com>

Otherwise subsequent code will dereference a misaligned
`struct dm_target_spec *`, which is undefined behavior.

Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
---
 drivers/md/dm-ioctl.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index cc77cf3d410921432eb0c62cdede7d55b9aa674a..34fa74c6a70db8aa67aaba3f6a2fc4f38ef736bc 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1394,6 +1394,13 @@ static inline fmode_t get_mode(struct dm_ioctl *param)
 static int next_target(struct dm_target_spec *last, uint32_t next, void *end,
 		       struct dm_target_spec **spec, char **target_params)
 {
+	static_assert(_Alignof(struct dm_target_spec) <= 8,
+		      "struct dm_target_spec has excessive alignment requirements");
+	if (next % 8) {
+		DMERR("Next target spec (offset %u) is not 8-byte aligned", next);
+		return -EINVAL;
+	}
+
 	*spec = (struct dm_target_spec *) ((unsigned char *) last + next);
 	*target_params = (char *) (*spec + 1);
 
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab


  reply	other threads:[~2023-05-30 20:54 UTC|newest]

Thread overview: 76+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-05-30 20:31 [dm-devel] [PATCH v2 00/16] Diskseq support in loop, device-mapper, and blkback Demi Marie Obenour
2023-05-30 20:31 ` Demi Marie Obenour
2023-05-30 20:31 ` Demi Marie Obenour [this message]
2023-05-30 20:31   ` [PATCH v2 01/16] device-mapper: Check that target specs are sufficiently aligned Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 02/16] device-mapper: Avoid pointer arithmetic overflow Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 03/16] device-mapper: do not allow targets to overlap 'struct dm_ioctl' Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 04/16] device-mapper: Better error message for too-short target spec Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 05/16] device-mapper: Target parameters must not overlap next " Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 06/16] device-mapper: Avoid double-fetch of version Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 07/16] device-mapper: Allow userspace to opt-in to strict parameter checks Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 08/16] device-mapper: Allow userspace to provide expected diskseq Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 09/16] device-mapper: Allow userspace to suppress uevent generation Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 10/16] device-mapper: Refuse to create device named "control" Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 11/16] device-mapper: "." and ".." are not valid symlink names Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 12/16] device-mapper: inform caller about already-existing device Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 13/16] xen-blkback: Implement diskseq checks Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-06-06  8:25   ` [dm-devel] " Roger Pau Monné
2023-06-06  8:25     ` Roger Pau Monné
2023-06-06 17:01     ` [dm-devel] " Demi Marie Obenour
2023-06-06 17:01       ` Demi Marie Obenour
2023-06-07  8:20       ` [dm-devel] " Roger Pau Monné
2023-06-07  8:20         ` Roger Pau Monné
2023-06-07 16:14         ` [dm-devel] " Demi Marie Obenour
2023-06-07 16:14           ` Demi Marie Obenour
2023-06-08  8:29           ` [dm-devel] " Roger Pau Monné
2023-06-08  8:29             ` Roger Pau Monné
2023-06-08 15:33             ` [dm-devel] " Demi Marie Obenour
2023-06-08 15:33               ` Demi Marie Obenour
2023-06-09 15:13               ` [dm-devel] " Roger Pau Monné
2023-06-09 15:13                 ` Roger Pau Monné
2023-06-09 16:55                 ` [dm-devel] " Demi Marie Obenour
2023-06-09 16:55                   ` Demi Marie Obenour
2023-06-12  8:09                   ` [dm-devel] " Roger Pau Monné
2023-06-12  8:09                     ` Roger Pau Monné
2023-06-21  1:14                     ` [dm-devel] " Demi Marie Obenour
2023-06-21  1:14                       ` Demi Marie Obenour
2023-06-21 10:07                       ` [dm-devel] " Roger Pau Monné
2023-06-21 10:07                         ` Roger Pau Monné
2023-05-30 20:31 ` [dm-devel] [PATCH v2 14/16] block, loop: Increment diskseq when releasing a loop device Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-05-30 20:31 ` [dm-devel] [PATCH v2 15/16] xen-blkback: Minor cleanups Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-06-06  8:36   ` [dm-devel] " Roger Pau Monné
2023-06-06  8:36     ` Roger Pau Monné
2023-05-30 20:31 ` [dm-devel] [PATCH v2 16/16] xen-blkback: Inform userspace that device has been opened Demi Marie Obenour
2023-05-30 20:31   ` Demi Marie Obenour
2023-06-06  9:15   ` [dm-devel] " Roger Pau Monné
2023-06-06  9:15     ` Roger Pau Monné
2023-06-06 17:31     ` [dm-devel] " Demi Marie Obenour
2023-06-06 17:31       ` Demi Marie Obenour
2023-06-07  8:44       ` [dm-devel] " Roger Pau Monné
2023-06-07  8:44         ` Roger Pau Monné
2023-06-07 16:29         ` [dm-devel] " Demi Marie Obenour
2023-06-07 16:29           ` Demi Marie Obenour
2023-06-08  9:11           ` [dm-devel] " Roger Pau Monné
2023-06-08  9:11             ` Roger Pau Monné
2023-06-08 15:23             ` [dm-devel] " Demi Marie Obenour
2023-06-08 15:23               ` Demi Marie Obenour
2023-06-08 10:08   ` [dm-devel] " Roger Pau Monné
2023-06-08 10:08     ` Roger Pau Monné
2023-06-08 15:24     ` [dm-devel] " Demi Marie Obenour
2023-06-08 15:24       ` Demi Marie Obenour
2023-05-31 13:06 ` [dm-devel] [PATCH v2 00/16] Diskseq support in loop, device-mapper, and blkback Christoph Hellwig
2023-05-31 13:06   ` Christoph Hellwig

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230530203116.2008-2-demi@invisiblethingslab.com \
    --to=demi@invisiblethingslab.com \
    --cc=agk@redhat.com \
    --cc=axboe@kernel.dk \
    --cc=dm-devel@redhat.com \
    --cc=linux-block@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marmarek@invisiblethingslab.com \
    --cc=roger.pau@citrix.com \
    --cc=snitzer@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=xen-devel@lists.xenproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.