From: Sasha Levin <sashal@kernel.org>
To: Ard Biesheuvel <ardb@kernel.org>
Cc: stable@vger.kernel.org, snitzer@redhat.com, agk@redhat.com,
dm-devel@redhat.com, Mikulas Patocka <mpatocka@redhat.com>,
Dan Carpenter <dan.carpenter@oracle.com>
Subject: Re: [PATCH stable] dm ioctl: fix out of bounds array access when no devices
Date: Wed, 19 May 2021 10:56:56 -0400 [thread overview]
Message-ID: <YKUnOBqGgfHPXX5F@sashalap> (raw)
In-Reply-To: <20210519074124.49890-1-ardb@kernel.org>
On Wed, May 19, 2021 at 09:41:24AM +0200, Ard Biesheuvel wrote:
>From: Mikulas Patocka <mpatocka@redhat.com>
>
>commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
>
>If there are not any dm devices, we need to zero the "dev" argument in
>the first structure dm_name_list. However, this can cause out of
>bounds write, because the "needed" variable is zero and len may be
>less than eight.
>
>Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
>too small to hold the "nl->dev" value.
>
>Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
>Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>Cc: stable@vger.kernel.org
>Signed-off-by: Mike Snitzer <snitzer@redhat.com>
>Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
>---
>Please apply to 4.4.y and 4.9.y
We already carry this patch via the backport provided in
https://lore.kernel.org/stable/20210513094552.266451-1-nobuhiro1.iwamatsu@toshiba.co.jp/
--
Thanks,
Sasha
next prev parent reply other threads:[~2021-05-19 14:56 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-19 7:41 [PATCH stable] dm ioctl: fix out of bounds array access when no devices Ard Biesheuvel
2021-05-19 14:56 ` Sasha Levin [this message]
2021-05-19 15:06 ` Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YKUnOBqGgfHPXX5F@sashalap \
--to=sashal@kernel.org \
--cc=agk@redhat.com \
--cc=ardb@kernel.org \
--cc=dan.carpenter@oracle.com \
--cc=dm-devel@redhat.com \
--cc=mpatocka@redhat.com \
--cc=snitzer@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox