Re: [PATCH stable] dm ioctl: fix out of bounds array access when no devices

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, 19 May 2021 at 16:56, Sasha Levin <sashal@xxxxxxxxxx> wrote:
>
> On Wed, May 19, 2021 at 09:41:24AM +0200, Ard Biesheuvel wrote:
> >From: Mikulas Patocka <mpatocka@xxxxxxxxxx>
> >
> >commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
> >
> >If there are not any dm devices, we need to zero the "dev" argument in
> >the first structure dm_name_list. However, this can cause out of
> >bounds write, because the "needed" variable is zero and len may be
> >less than eight.
> >
> >Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
> >too small to hold the "nl->dev" value.
> >
> >Signed-off-by: Mikulas Patocka <mpatocka@xxxxxxxxxx>
> >Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> >Cc: stable@xxxxxxxxxxxxxxx
> >Signed-off-by: Mike Snitzer <snitzer@xxxxxxxxxx>
> >Signed-off-by: Ard Biesheuvel <ardb@xxxxxxxxxx>
> >---
> >Please apply to 4.4.y and 4.9.y
>
> We already carry this patch via the backport provided in
> https://lore.kernel.org/stable/20210513094552.266451-1-nobuhiro1.iwamatsu@xxxxxxxxxxxxx/
>

Excellent, thanks.

--
dm-devel mailing list
dm-devel@xxxxxxxxxx
https://listman.redhat.com/mailman/listinfo/dm-devel




[Index of Archives]     [DM Crypt]     [Fedora Desktop]     [ATA RAID]     [Fedora Marketing]     [Fedora Packaging]     [Fedora SELinux]     [Yosemite Discussion]     [KDE Users]     [Fedora Docs]

  Powered by Linux