Archive-only list for patches
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev,
	Andreas Hindborg <a.hindborg@samsung.com>,
	Ming Lei <ming.lei@redhat.com>, Jens Axboe <axboe@kernel.dk>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10 13/59] null_blk: fix validation of block size
Date: Thu, 25 Jul 2024 16:37:03 +0200	[thread overview]
Message-ID: <20240725142733.767770757@linuxfoundation.org> (raw)
In-Reply-To: <20240725142733.262322603@linuxfoundation.org>

5.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andreas Hindborg <a.hindborg@samsung.com>

[ Upstream commit c462ecd659b5fce731f1d592285832fd6ad54053 ]

Block size should be between 512 and PAGE_SIZE and be a power of 2. The current
check does not validate this, so update the check.

Without this patch, null_blk would Oops due to a null pointer deref when
loaded with bs=1536 [1].

Link: https://lore.kernel.org/all/87wmn8mocd.fsf@metaspace.dk/

Signed-off-by: Andreas Hindborg <a.hindborg@samsung.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20240603192645.977968-1-nmi@metaspace.dk
[axboe: remove unnecessary braces and != 0 check]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/null_blk/main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index 862a9420df526..8e24fb93324cb 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -1743,8 +1743,8 @@ static int null_validate_conf(struct nullb_device *dev)
 		return -EINVAL;
 	}
 
-	dev->blocksize = round_down(dev->blocksize, 512);
-	dev->blocksize = clamp_t(unsigned int, dev->blocksize, 512, 4096);
+	if (blk_validate_block_size(dev->blocksize))
+		return -EINVAL;
 
 	if (dev->queue_mode == NULL_Q_MQ && dev->use_per_node_hctx) {
 		if (dev->submit_queues != nr_online_nodes)
-- 
2.43.0




  parent reply	other threads:[~2024-07-25 14:47 UTC|newest]

Thread overview: 67+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-07-25 14:36 [PATCH 5.10 00/59] 5.10.223-rc1 review Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 01/59] gcc-plugins: Rename last_stmt() for GCC 14+ Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 02/59] filelock: Remove locks reliably when fcntl/close race is detected Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 03/59] scsi: qedf: Set qed_slowpath_params to zero before use Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 04/59] ACPI: EC: Abort address space access upon error Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 05/59] ACPI: EC: Avoid returning AE_OK on errors in address space handler Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 06/59] wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 07/59] wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan() Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 08/59] selftests/openat2: Fix build warnings on ppc64 Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 09/59] Input: silead - Always support 10 fingers Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 10/59] net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 11/59] ila: block BH in ila_output() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 12/59] arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process Greg Kroah-Hartman
2024-07-25 14:37 ` Greg Kroah-Hartman [this message]
2024-07-25 14:37 ` [PATCH 5.10 14/59] kconfig: gconf: give a proper initial state to the Save button Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 15/59] kconfig: remove wrong expr_trans_bool() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 16/59] fs/file: fix the check in find_next_fd() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 17/59] mei: demote client disconnect warning on suspend to debug Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 18/59] wifi: cfg80211: wext: add extra SIOCSIWSCAN data check Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 19/59] KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 20/59] ALSA: hda/realtek: Add more codec ID to no shutup pins list Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 21/59] mips: fix compat_sys_lseek syscall Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 22/59] Input: elantech - fix touchpad state on resume for Lenovo N24 Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 23/59] Input: i8042 - add Ayaneo Kun to i8042 quirk table Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 24/59] bytcr_rt5640 : inverse jack detect for Archos 101 cesium Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 25/59] ALSA: dmaengine: Synchronize dma channel after drop() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 26/59] ASoC: ti: davinci-mcasp: Set min period size using FIFO config Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 27/59] ASoC: ti: omap-hdmi: Fix too long driver name Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 28/59] can: kvaser_usb: fix return value for hif_usb_send_regout Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 29/59] s390/sclp: Fix sclp_init() cleanup on failure Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 30/59] btrfs: qgroup: fix quota root leak after quota disable failure Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 31/59] ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 32/59] ALSA: dmaengine_pcm: terminate dmaengine before synchronize Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 33/59] net: usb: qmi_wwan: add Telit FN912 compositions Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 34/59] net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 35/59] powerpc/pseries: Whitelist dtl slub object for copying to userspace Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 36/59] powerpc/eeh: avoid possible crash when edev->pdev changes Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 37/59] scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 38/59] Bluetooth: hci_core: cancel all works upon hci_unregister_dev() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 39/59] fs: better handle deep ancestor chains in is_subdir() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 40/59] spi: imx: Dont expect DMA for i.MX{25,35,50,51,53} cspi devices Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 41/59] selftests/vDSO: fix clang build errors and warnings Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 42/59] hfsplus: fix uninit-value in copy_name Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 43/59] spi: mux: set ctlr->bits_per_word_mask Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 44/59] ARM: 9324/1: fix get_user() broken with veneer Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 45/59] ACPI: processor_idle: Fix invalid comparison with insertion sort for latency Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 46/59] bpf: Fix overrunning reservations in ringbuf Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 47/59] bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 48/59] scsi: core: Fix a use-after-free Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 49/59] ext4: fix error code saved on super block during file system abort Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 50/59] ext4: Send notifications on error Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 51/59] drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 52/59] net: relax socket state check at accept time Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 53/59] ocfs2: add bounds checking to ocfs2_check_dir_entry() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 54/59] jfs: dont walk off the end of ealist Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 55/59] ALSA: hda/realtek: Enable headset mic on Positivo SU C1400 Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 56/59] ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 57/59] arm64: dts: qcom: msm8996: Disable SS instance in Parkmode for USB Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 58/59] ALSA: pcm_dmaengine: Dont synchronize DMA channel when DMA is paused Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 59/59] filelock: Fix fcntl/close race recovery compat path Greg Kroah-Hartman
2024-07-25 17:36 ` [PATCH 5.10 00/59] 5.10.223-rc1 review ChromeOS Kernel Stable Merge
2024-07-26  4:19 ` Dominique Martinet
2024-07-26  8:10 ` Pavel Machek
2024-07-26 11:35 ` Mark Brown
2024-07-26 17:12 ` Jon Hunter
2024-07-26 17:27 ` Florian Fainelli
2024-07-26 17:33 ` Naresh Kamboju

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240725142733.767770757@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=a.hindborg@samsung.com \
    --cc=axboe@kernel.dk \
    --cc=ming.lei@redhat.com \
    --cc=patches@lists.linux.dev \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox