From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk, Mikulas Patocka <mpatocka@redhat.com>,
Alasdair G Kergon <agk@redhat.com>
Subject: [ 04/52] dm verity: fix overflow check
Date: Thu, 4 Oct 2012 14:20:55 -0700 [thread overview]
Message-ID: <20121004210635.889254121@linuxfoundation.org> (raw)
In-Reply-To: <20121004210635.372689554@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 1d55f6bcc0331d744cd5b56c4ee79e3809438161 upstream.
This patch fixes sector_t overflow checking in dm-verity.
Without this patch, the code checks for overflow only if sector_t is
smaller than long long, not if sector_t and long long have the same size.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-verity.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/md/dm-verity.c
+++ b/drivers/md/dm-verity.c
@@ -718,8 +718,8 @@ static int verity_ctr(struct dm_target *
v->hash_dev_block_bits = ffs(num) - 1;
if (sscanf(argv[5], "%llu%c", &num_ll, &dummy) != 1 ||
- num_ll << (v->data_dev_block_bits - SECTOR_SHIFT) !=
- (sector_t)num_ll << (v->data_dev_block_bits - SECTOR_SHIFT)) {
+ (sector_t)(num_ll << (v->data_dev_block_bits - SECTOR_SHIFT))
+ >> (v->data_dev_block_bits - SECTOR_SHIFT) != num_ll) {
ti->error = "Invalid data blocks";
r = -EINVAL;
goto bad;
@@ -733,8 +733,8 @@ static int verity_ctr(struct dm_target *
}
if (sscanf(argv[6], "%llu%c", &num_ll, &dummy) != 1 ||
- num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT) !=
- (sector_t)num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT)) {
+ (sector_t)(num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT))
+ >> (v->hash_dev_block_bits - SECTOR_SHIFT) != num_ll) {
ti->error = "Invalid hash start";
r = -EINVAL;
goto bad;
next prev parent reply other threads:[~2012-10-04 21:23 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-04 21:20 [ 00/52] 3.4.13-stable review Greg Kroah-Hartman
2012-10-04 21:20 ` [ 01/52] vfs: dcache: fix deadlock in tree traversal Greg Kroah-Hartman
2012-10-04 21:20 ` [ 02/52] dm: handle requests beyond end of device instead of using BUG_ON Greg Kroah-Hartman
2012-10-04 21:20 ` [ 03/52] dm table: clear add_random unless all devices have it set Greg Kroah-Hartman
2012-10-04 21:20 ` Greg Kroah-Hartman [this message]
2012-10-04 21:20 ` [ 05/52] usb: gadget: dummy_hcd: fixup error probe path Greg Kroah-Hartman
2012-10-04 21:20 ` [ 06/52] USB: option: blacklist QMI interface on ZTE MF683 Greg Kroah-Hartman
2012-10-04 21:20 ` [ 07/52] USB: ftdi_sio: add TIAO USB Multi-Protocol Adapter (TUMPA) support Greg Kroah-Hartman
2012-10-04 21:20 ` [ 08/52] USB: qcaux: add Pantech vendor class match Greg Kroah-Hartman
2012-10-04 21:21 ` [ 09/52] usb: host: xhci: Fix Null pointer dereferencing with 71c731a for non-x86 systems Greg Kroah-Hartman
2012-10-04 21:21 ` [ 10/52] staging: speakup_soft: Fix reading of init string Greg Kroah-Hartman
2012-10-04 21:21 ` [ 11/52] tty: keyboard.c: Remove locking from vt_get_leds Greg Kroah-Hartman
2012-10-04 21:21 ` [ 12/52] staging: r8712u: Do not queue cloned skb Greg Kroah-Hartman
2012-10-04 21:21 ` [ 13/52] staging: comedi: s626: dont dereference insn->data Greg Kroah-Hartman
2012-10-04 21:21 ` [ 14/52] staging: comedi: jr3_pci: fix iomem dereference Greg Kroah-Hartman
2012-10-04 21:21 ` [ 15/52] staging: comedi: dont dereference user memory for INSN_INTTRIG Greg Kroah-Hartman
2012-10-04 21:21 ` [ 16/52] staging: comedi: fix memory leak for saved channel list Greg Kroah-Hartman
2012-10-04 21:21 ` [ 17/52] Remove BUG_ON from n_tty_read() Greg Kroah-Hartman
2012-10-04 21:21 ` [ 18/52] TTY: ttyprintk, dont touch behind tty->write_buf Greg Kroah-Hartman
2012-10-04 21:21 ` [ 19/52] serial: omap: fix software flow control Greg Kroah-Hartman
2012-10-04 21:21 ` [ 20/52] serial: pl011: handle corruption at high clock speeds Greg Kroah-Hartman
2012-10-04 21:21 ` [ 21/52] serial: set correct baud_base for EXSYS EX-41092 Dual 16950 Greg Kroah-Hartman
2012-10-04 21:21 ` [ 22/52] tools/hv: Fix file handle leak Greg Kroah-Hartman
2012-10-04 21:21 ` [ 23/52] tools/hv: Fix exit() error code Greg Kroah-Hartman
2012-10-04 21:21 ` [ 24/52] tools/hv: Check for read/write errors Greg Kroah-Hartman
2012-10-04 21:21 ` [ 25/52] b43legacy: Fix crash on unload when firmware not available Greg Kroah-Hartman
2012-10-04 21:21 ` [ 26/52] firmware: Add missing attributes to EFI variable attribute print out from sysfs Greg Kroah-Hartman
2012-10-04 21:21 ` [ 27/52] xhci: Intel Panther Point BEI quirk Greg Kroah-Hartman
2012-10-04 21:21 ` [ 28/52] xHCI: add cmd_ring_state Greg Kroah-Hartman
2012-10-07 0:54 ` Ben Hutchings
2012-10-07 14:39 ` Greg Kroah-Hartman
2012-10-04 21:21 ` [ 29/52] xHCI: add aborting command ring function Greg Kroah-Hartman
2012-10-07 1:02 ` Ben Hutchings
2012-10-08 20:48 ` Sarah Sharp
2012-10-04 21:21 ` [ 30/52] xHCI: cancel command after command timeout Greg Kroah-Hartman
2012-10-04 21:21 ` [ 31/52] xHCI: handle command after aborting the command ring Greg Kroah-Hartman
2012-10-04 21:21 ` [ 32/52] Increase XHCI suspend timeout to 16ms Greg Kroah-Hartman
2012-10-04 21:21 ` [ 33/52] ath9k: Disable ASPM only for AR9285 Greg Kroah-Hartman
2012-10-04 21:21 ` [ 34/52] coredump: prevent double-free on an error path in core dumper Greg Kroah-Hartman
2012-10-04 21:21 ` [ 35/52] n_gsm.c: Implement 3GPP27.010 DLC start-up procedure in MUX Greg Kroah-Hartman
2012-10-04 21:21 ` [ 36/52] n_gsm: uplink SKBs accumulate on list Greg Kroah-Hartman
2012-10-04 21:21 ` [ 37/52] n_gsm: added interlocking for gsm_data_lock for certain code paths Greg Kroah-Hartman
2012-10-04 21:21 ` [ 38/52] n_gsm: memory leak in uplink error path Greg Kroah-Hartman
2012-10-04 21:21 ` [ 39/52] UBI: fix autoresize handling in R/O mode Greg Kroah-Hartman
2012-10-04 21:21 ` [ 40/52] Yama: handle 32-bit userspace prctl Greg Kroah-Hartman
2012-10-04 21:21 ` [ 41/52] SCSI: ibmvscsi: Fix host config length field overflow Greg Kroah-Hartman
2012-10-04 21:21 ` [ 42/52] SCSI: hpsa: Use LUN reset instead of target reset Greg Kroah-Hartman
2012-10-04 21:21 ` [ 43/52] can: mscan-mpc5xxx: fix return value check in mpc512x_can_get_clock() Greg Kroah-Hartman
2012-10-04 21:21 ` [ 44/52] remoteproc: select VIRTIO to avoid build breakage Greg Kroah-Hartman
2012-10-04 21:21 ` [ 45/52] remoteproc: fix a potential NULL-dereference on cleanup Greg Kroah-Hartman
2012-10-04 21:21 ` [ 46/52] IPoIB: Fix use-after-free of multicast object Greg Kroah-Hartman
2012-10-04 21:21 ` [ 47/52] IB/srp: Fix use-after-free in srp_reset_req() Greg Kroah-Hartman
2012-10-04 21:21 ` [ 48/52] IB/srp: Avoid having aborted requests hang Greg Kroah-Hartman
2012-10-04 21:21 ` [ 49/52] isci: fix isci_pci_probe() generates warning on efi failure path Greg Kroah-Hartman
2012-10-04 21:21 ` [ 50/52] x86/alternatives: Fix p6 nops on non-modular kernels Greg Kroah-Hartman
2012-10-04 21:21 ` [ 51/52] SCSI: scsi_remove_target: fix softlockup regression on hot remove Greg Kroah-Hartman
2012-10-04 21:21 ` [ 52/52] SCSI: scsi_dh_alua: Enable STPG for unavailable ports Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121004210635.889254121@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=agk@redhat.com \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=mpatocka@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).