From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 12A353955C2; Tue, 12 May 2026 17:57:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778608629; cv=none; b=nN9ftwvvwLva2XJ+xbZXNfqz2YSgLpXpOfS6DvQDxMvL0c3wTGNvIRqKiFWah5DsgOvJU5RZ+xlAqln/prQ8/E42MYB0q9ON1E4XzL9TQqKZVRs08FdS74ksbUYEqguqOTgJXWrSGa7S7Oy7K8SZNvwcD1ocDrS3XPj8f/qz478= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778608629; c=relaxed/simple; bh=uqjQmA0aCXUeAu8R4yykqlDkSIYfSRXVigsLS/QawNU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HOzgW5lv9j5JJWdss86EL14/NtMjV7dUyc6xRxif8wwzfhIT/uEMb+/u4eyjjsG+UgrESGmdVALgdkBbhf67yUP0CDGKEwmXgpgXyqQADRl9T64eANKi3vPUwb46aDyphLjPplF3G8XSxU5jNTLkvS/FG4ImX0EZtcAM8jc1pXo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=d5IPYh3f; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="d5IPYh3f" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E69EC2BCB0; Tue, 12 May 2026 17:57:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778608629; bh=uqjQmA0aCXUeAu8R4yykqlDkSIYfSRXVigsLS/QawNU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d5IPYh3f3xEWmDNjF5fIE/TtjA+Dt//benrU4dmULBoP6LV9CbepVovxQg1nMgm/F 0qficovjp4c1qoWtgp2i7/AfZUSpnq7KssaQyy2JJWPPvhsHucfkxslNFpxeOS7wCD qJQae9KhG5Wy6LL1AZl2k66Cw9SQisz4/AkHaHSE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tony Asleson , Mikulas Patocka , "Bryn M. Reeves" Subject: [PATCH 6.18 152/270] dm: fix a buffer overflow in ioctl processing Date: Tue, 12 May 2026 19:39:13 +0200 Message-ID: <20260512173941.649998881@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260512173938.452574370@linuxfoundation.org> References: <20260512173938.452574370@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mikulas Patocka commit 2fa49cc884f6496a915c35621ba4da35649bf159 upstream. Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn't check overflow, so outptr could point past the buffer end 4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number 6. With "remaining" being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally Reported-by: Tony Asleson Signed-off-by: Mikulas Patocka Reviewed-by: Bryn M. Reeves Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/md/dm-ioctl.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1341,6 +1341,10 @@ static void retrieve_status(struct dm_ta used = param->data_start + (outptr - outbuf); outptr = align_ptr(outptr); + if (!outptr || outptr > outbuf + len) { + param->flags |= DM_BUFFER_FULL_FLAG; + break; + } spec->next = outptr - outbuf; }