Patch "dm-verity: fix buffer overflow in FEC calculation" has been added to the 6.12-stable tree

Patch "dm-verity: fix buffer overflow in FEC calculation" has been added to the 6.12-stable tree

[Sasha Levin]

This is a note to let you know that I've just added the patch titled

    dm-verity: fix buffer overflow in FEC calculation

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     dm-verity-fix-buffer-overflow-in-fec-calculation.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.



commit 411c76502f137eb1efc843e35d996e42eaa3db37
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Wed Jul 1 18:13:50 2026 +0200

    dm-verity: fix buffer overflow in FEC calculation
    
    [ Upstream commit 31d6e6c0ba8d5a7bd59660035a089307100c5e8e ]
    
    There's a buffer overflow in dm-verity-fec:
    
    if (neras && *neras <= v->fec->roots)
            fio->erasures[(*neras)++] = i;
    
    This allows *neras to reach roots + 1 (the post-increment pushes it past
    roots). This value is then passed as no_eras to decode_rs8(). Inside the
    RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator
    polynomial loop writes lambda[j] where j can reach nroots + 1 — one
    element past the end of lambda[] (which is sized nroots + 1, valid
    indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting
    the syndrome buffer.
    
    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Assisted-by: Claude:claude-opus-4-6
    Cc: stable@vger.kernel.org
    Fixes: a739ff3f543a ("dm verity: add support for forward error correction")
    Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
index 56813d02d5465..b6115ac9c8256 100644
--- a/drivers/md/dm-verity-fec.c
+++ b/drivers/md/dm-verity-fec.c
@@ -263,7 +263,7 @@ static int fec_read_bufs(struct dm_verity *v, struct dm_verity_io *io,
 				     (unsigned long long)block, PTR_ERR(bbuf));
 
 			/* assume the block is corrupted */
-			if (neras && *neras <= v->fec->roots)
+			if (neras && *neras < v->fec->roots)
 				fio->erasures[(*neras)++] = i;
 
 			continue;
@@ -281,7 +281,7 @@ static int fec_read_bufs(struct dm_verity *v, struct dm_verity_io *io,
 			 * skip if we have already found the theoretical
 			 * maximum number (i.e. fec->roots) of erasures
 			 */
-			if (neras && *neras <= v->fec->roots &&
+			if (neras && *neras < v->fec->roots &&
 			    fec_is_erasure(v, io, want_digest, bbuf))
 				fio->erasures[(*neras)++] = i;
 		}