From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8252481DD; Sat, 30 May 2026 17:01:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780160482; cv=none; b=k7HC8SxaHN7v33f/P3GTRh9dHddj0zvm5+AAuBtESJY1f6a5rgx9qyXbTkgLgHDCxNMvzALoJx9i0iEl2bDoqGYea2b4HsLIL0vo5GufBVF1yomt49u7N5f5rWGM5xRp4azphMPqF58INxJkhgLmz6yvoxoBb8NX5jO/W3Bh4ZA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780160482; c=relaxed/simple; bh=/gcWVnpTMJ8/5awFc2qFaeAZT45b+F4U6hey4+rcQco=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=H8qK1JMmh3wAFM7sV5iccTFDjFkRE+0SozNcHdyWvRiZ7MLprIcb/H3O4IcTZxy4d7OZej9IfN9OUBaEqriTGxWTC4ZxzNl7gKnZ4XPQs3zzaJmBbh5ALrBdwD2zud8nPB8fjyXvfkVhMafoKhMAmnOfgQb4CcS+g9yTjOWe/3Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KskSb15d; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="KskSb15d" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23FCF1F00893; Sat, 30 May 2026 17:01:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1780160481; bh=4NWaHR0aAIBToX3oVIWrfRddG+pUq6QbsNks7jPXjOw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=KskSb15d4BL4qQXDQAeadZ7dt23S8P0NUHNhC2JRN51BLkiKI7gs2tQ3lz7zfwA2s 9yOAdnVNrDpa6EjZt2lkllBZd0TPm2zxK4CsBFb9p3vEBukG0MoieD2ojYEpyL7plh wpIUYF8Qn1CjqCJL231gs9DGncpN9P8vOIEEgdao= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tony Asleson , Mikulas Patocka , "Bryn M. Reeves" Subject: [PATCH 6.1 351/969] dm: fix a buffer overflow in ioctl processing Date: Sat, 30 May 2026 17:57:55 +0200 Message-ID: <20260530160310.046884049@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260530160300.485627683@linuxfoundation.org> References: <20260530160300.485627683@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mikulas Patocka commit 2fa49cc884f6496a915c35621ba4da35649bf159 upstream. Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn't check overflow, so outptr could point past the buffer end 4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number 6. With "remaining" being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally Reported-by: Tony Asleson Signed-off-by: Mikulas Patocka Reviewed-by: Bryn M. Reeves Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/md/dm-ioctl.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1316,6 +1316,10 @@ static void retrieve_status(struct dm_ta used = param->data_start + (outptr - outbuf); outptr = align_ptr(outptr); + if (!outptr || outptr > outbuf + len) { + param->flags |= DM_BUFFER_FULL_FLAG; + break; + } spec->next = outptr - outbuf; }