diff mbox series

[for,4.4,and,4.9] dm ioctl: fix out of bounds array access when no devices

Message ID 20210513094552.266451-1-nobuhiro1.iwamatsu@toshiba.co.jp
State New
Headers show
Series [for,4.4,and,4.9] dm ioctl: fix out of bounds array access when no devices | expand

Commit Message

Nobuhiro Iwamatsu May 13, 2021, 9:45 a.m. UTC 
From: Mikulas Patocka <mpatocka@redhat.com>

commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.

If there are not any dm devices, we need to zero the "dev" argument in
the first structure dm_name_list. However, this can cause out of
bounds write, because the "needed" variable is zero and len may be
less than eight.

Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
too small to hold the "nl->dev" value.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
[iwamatsu: Adjust context]
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
---
 drivers/md/dm-ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Greg KH May 17, 2021, 11:38 a.m. UTC | #1 
On Thu, May 13, 2021 at 06:45:52PM +0900, Nobuhiro Iwamatsu wrote:
> From: Mikulas Patocka <mpatocka@redhat.com>

> 

> commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.

> 

> If there are not any dm devices, we need to zero the "dev" argument in

> the first structure dm_name_list. However, this can cause out of

> bounds write, because the "needed" variable is zero and len may be

> less than eight.

> 

> Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is

> too small to hold the "nl->dev" value.

> 

> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

> Cc: stable@vger.kernel.org

> Signed-off-by: Mike Snitzer <snitzer@redhat.com>

> [iwamatsu: Adjust context]

> Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>

> ---

>  drivers/md/dm-ioctl.c | 2 +-

>  1 file changed, 1 insertion(+), 1 deletion(-)


Now queued up, thanks.

greg k-h
diff mbox series

Patch

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 836a2808c0c712..eb2659a1231081 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -524,7 +524,7 @@  static int list_devices(struct dm_ioctl *param, size_t param_size)
 	 * Grab our output buffer.
 	 */
 	nl = get_result_buffer(param, param_size, &len);
-	if (len < needed) {
+	if (len < needed || len < sizeof(nl->dev)) {
 		param->flags |= DM_BUFFER_FULL_FLAG;
 		goto out;
 	}