Re: [PATCH for 4.4 and 4.9] dm ioctl: fix out of bounds array access when no devices

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, May 13, 2021 at 06:45:52PM +0900, Nobuhiro Iwamatsu wrote:
> From: Mikulas Patocka <mpatocka@redhat.com>
> 
> commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
> 
> If there are not any dm devices, we need to zero the "dev" argument in
> the first structure dm_name_list. However, this can cause out of
> bounds write, because the "needed" variable is zero and len may be
> less than eight.
> 
> Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
> too small to hold the "nl->dev" value.
> 
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
> [iwamatsu: Adjust context]
> Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
> ---
>  drivers/md/dm-ioctl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Now queued up, thanks.

greg k-h