On Thu, May 13, 2021 at 06:45:52PM +0900, Nobuhiro Iwamatsu wrote: > From: Mikulas Patocka <mpatocka@xxxxxxxxxx> > > commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream. > > If there are not any dm devices, we need to zero the "dev" argument in > the first structure dm_name_list. However, this can cause out of > bounds write, because the "needed" variable is zero and len may be > less than eight. > > Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is > too small to hold the "nl->dev" value. > > Signed-off-by: Mikulas Patocka <mpatocka@xxxxxxxxxx> > Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: Mike Snitzer <snitzer@xxxxxxxxxx> > [iwamatsu: Adjust context] > Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@xxxxxxxxxxxxx> > --- > drivers/md/dm-ioctl.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Now queued up, thanks. greg k-h
