mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/drivers/md
History
Mikulas Patocka 5398b8e275 dm ioctl: fix misbehavior if list_versions races with module loading 
commit 4fe1ec9954 upstream.

__list_versions will first estimate the required space using the
"dm_target_iterate(list_version_get_needed, &needed)" call and then will
fill the space using the "dm_target_iterate(list_version_get_info,
&iter_info)" call. Each of these calls locks the targets using the
"down_read(&_lock)" and "up_read(&_lock)" calls, however between the first
and second "dm_target_iterate" there is no lock held and the target
modules can be loaded at this point, so the second "dm_target_iterate"
call may need more space than what was the first "dm_target_iterate"
returned.

The code tries to handle this overflow (see the beginning of
list_version_get_info), however this handling is incorrect.

The code sets "param->data_size = param->data_start + needed" and
"iter_info.end = (char *)vers+len" - "needed" is the size returned by the
first dm_target_iterate call; "len" is the size of the buffer allocated by
userspace.

"len" may be greater than "needed"; in this case, the code will write up
to "len" bytes into the buffer, however param->data_size is set to
"needed", so it may write data past the param->data_size value. The ioctl
interface copies only up to param->data_size into userspace, thus part of
the result will be truncated.

Fix this bug by setting "iter_info.end = (char *)vers + needed;" - this
guarantees that the second "dm_target_iterate" call will write only up to
the "needed" buffer and it will exit with "DM_BUFFER_FULL_FLAG" if it
overflows the "needed" space - in this case, userspace will allocate a
larger buffer and retry.

Note that there is also a bug in list_version_get_needed - we need to add
"strlen(tt->name) + 1" to the needed size, not "strlen(tt->name)".

Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2022-11-26 09:27:48 +01:00
..
bcache bcache: fix set_at_max_writeback_rate() for multiple attached devices 2022-10-21 12:39:22 +02:00
persistent-data dm bufio: Add flags argument to dm_bufio_client_create 2022-07-28 17:46:14 -04:00
Kconfig blk-mq: make the blk-mq stacking code optional 2022-02-16 19:39:09 -07:00
Makefile hardening updates for v5.20-rc1 2022-08-02 14:38:59 -07:00
dm-audit.c dm: introduce audit event module for device mapper 2021-10-27 16:53:47 -04:00
dm-audit.h dm: introduce audit event module for device mapper 2021-10-27 16:53:47 -04:00
dm-bio-prison-v1.c
…
dm-bio-prison-v1.h
…
dm-bio-prison-v2.c
…
dm-bio-prison-v2.h
…
dm-bio-record.h block: move integrity handling out of <linux/blkdev.h> 2021-10-18 06:17:02 -06:00
dm-bufio.c dm bufio: Fix missing decrement of no_sleep_enabled if dm_bufio_client_create failed 2022-11-26 09:27:48 +01:00
dm-builtin.c
…
dm-cache-background-tracker.c
…
dm-cache-background-tracker.h
…
dm-cache-block-types.h
…
dm-cache-metadata.c dm cache metadata: remove unnecessary variable in __dump_mapping 2022-05-09 15:40:10 -04:00
dm-cache-metadata.h dm cache: fix typo in 2 comment blocks 2022-07-07 11:49:37 -04:00
dm-cache-policy-internal.h
…
dm-cache-policy-smq.c dm cache policy smq: make static read-only array table const 2022-02-22 10:35:53 -05:00
dm-cache-policy.c
…
dm-cache-policy.h
…
dm-cache-target.c dm cache: fix typo in 2 comment blocks 2022-07-07 11:49:37 -04:00
dm-clone-metadata.c
…
dm-clone-metadata.h
…
dm-clone-target.c dm clone: Fix typo in block_device format specifier 2022-10-26 12:22:57 +02:00
dm-core.h dm table: audit all dm_table_get_target() callers 2022-07-07 11:49:34 -04:00
dm-crypt.c dm-crypt: provide dma_alignment limit in io_hints 2022-11-26 09:27:40 +01:00
dm-delay.c dm: simplify basic targets 2022-05-05 17:31:35 -04:00
dm-dust.c dm: use bdev_nr_sectors and bdev_nr_bytes instead of open coding them 2021-10-18 14:43:22 -06:00
dm-ebs-target.c - Add flags argument to dm_bufio_client_create and introduce 2022-08-06 11:09:55 -07:00
dm-era-target.c dm era: commit metadata in postsuspend after worker stops 2022-06-21 13:35:01 -04:00
dm-exception-store.c
…
dm-exception-store.h dm: use bdev_nr_sectors and bdev_nr_bytes instead of open coding them 2021-10-18 14:43:22 -06:00
dm-flakey.c dm/dm-flakey: Use the new blk_opf_t type 2022-07-14 12:14:31 -06:00
dm-ima.c dm table: audit all dm_table_get_target() callers 2022-07-07 11:49:34 -04:00
dm-ima.h dm ima: add version info to dm related events in ima log 2021-08-20 15:59:47 -04:00
dm-init.c
…
dm-integrity.c - Add flags argument to dm_bufio_client_create and introduce 2022-08-06 11:09:55 -07:00
dm-io-rewind.c dm: add two stage requeue mechanism 2022-07-07 11:49:32 -04:00
dm-io-tracker.h dm writecache: make writeback pause configurable 2021-06-28 16:30:13 -04:00
dm-io.c dm/core: Combine request operation type and flags 2022-07-14 12:14:31 -06:00
dm-ioctl.c dm ioctl: fix misbehavior if list_versions races with module loading 2022-11-26 09:27:48 +01:00
dm-kcopyd.c - Refactor DM core's mempool allocation so that it clearer by not 2022-08-02 14:21:25 -07:00
dm-linear.c libnvdimm for 5.19 2022-05-27 15:49:30 -07:00
dm-log-userspace-base.c dm: update target status functions to support IMA measurement 2021-08-10 13:34:23 -04:00
dm-log-userspace-transfer.c
…
dm-log-userspace-transfer.h
…
dm-log-writes.c libnvdimm for 5.19 2022-05-27 15:49:30 -07:00
dm-log.c dm mirror log: Use the new blk_opf_t type 2022-07-14 12:14:31 -06:00
dm-mpath.c dm mpath: provide high-resolution timer to HST for bio-based 2022-05-09 15:39:23 -04:00
dm-mpath.h
…
dm-path-selector.c
…
dm-path-selector.h dm mpath: provide high-resolution timer to HST for bio-based 2022-05-09 15:39:23 -04:00
dm-ps-historical-service-time.c dm mpath: provide high-resolution timer to HST for bio-based 2022-05-09 15:39:23 -04:00
dm-ps-io-affinity.c dm: update target status functions to support IMA measurement 2021-08-10 13:34:23 -04:00
dm-ps-queue-length.c dm: update target status functions to support IMA measurement 2021-08-10 13:34:23 -04:00
dm-ps-round-robin.c dm: update target status functions to support IMA measurement 2021-08-10 13:34:23 -04:00
dm-ps-service-time.c dm: update target status functions to support IMA measurement 2021-08-10 13:34:23 -04:00
dm-raid.c md: unlock mddev before reap sync_thread in action_store 2022-08-02 17:14:40 -06:00
dm-raid1.c dm/core: Reduce the size of struct dm_io_request 2022-07-14 12:14:31 -06:00
dm-region-hash.c
…
dm-rq.c dm: unexport dm_get_reserved_rq_based_ios 2022-06-29 12:46:05 -04:00
dm-rq.h
…
dm-snap-persistent.c - Add flags argument to dm_bufio_client_create and introduce 2022-08-06 11:09:55 -07:00
dm-snap-transient.c dm: update target status functions to support IMA measurement 2021-08-10 13:34:23 -04:00
dm-snap.c dm snapshot: fix typo in snapshot_map() comment 2022-07-07 11:49:39 -04:00
dm-stats.c dm stats: add cond_resched when looping over entries 2022-05-09 12:11:07 -04:00
dm-stats.h dm stats: fix too short end duration_ns when using precise_timestamps 2022-02-21 15:35:39 -05:00
dm-stripe.c dax: add .recovery_write dax_operation 2022-05-16 13:37:59 -07:00
dm-switch.c dm: use bdev_nr_sectors and bdev_nr_bytes instead of open coding them 2021-10-18 14:43:22 -06:00
dm-sysfs.c dm sysfs: use default_groups in kobj_type 2022-01-06 09:48:55 -05:00
dm-table.c - Refactor DM core's mempool allocation so that it clearer by not 2022-08-02 14:21:25 -07:00
dm-target.c dax: introduce DAX_RECOVERY_WRITE dax access mode 2022-05-16 13:35:56 -07:00
dm-thin-metadata.c dm thin: fix use-after-free crash in dm_sm_register_threshold_callback 2022-07-15 18:09:14 -04:00
dm-thin-metadata.h dm thin metadata: remove unused dm_thin_remove_block and __remove 2022-02-22 13:55:50 -05:00
dm-thin.c dm thin: fix use-after-free crash in dm_sm_register_threshold_callback 2022-07-15 18:09:14 -04:00
dm-uevent.c
…
dm-uevent.h
…
dm-unstripe.c dm: update target status functions to support IMA measurement 2021-08-10 13:34:23 -04:00
dm-verity-fec.c dm bufio: Add flags argument to dm_bufio_client_create 2022-07-28 17:46:14 -04:00
dm-verity-fec.h
…
dm-verity-loadpin.c dm: verity-loadpin: Only trust verity targets with enforcement 2022-10-21 12:37:40 +02:00
dm-verity-target.c dm: verity-loadpin: Only trust verity targets with enforcement 2022-10-21 12:37:40 +02:00
dm-verity-verify-sig.c dm verity: fix require_signatures module_param permissions 2021-05-25 16:14:05 -04:00
dm-verity-verify-sig.h
…
dm-verity.h dm: verity-loadpin: Only trust verity targets with enforcement 2022-10-21 12:37:40 +02:00
dm-writecache.c - A few fixes for the DM verity and bufio changes from the 6.0 merge. 2022-08-11 19:46:48 -07:00
dm-zero.c
…
dm-zone.c - Refactor DM core's mempool allocation so that it clearer by not 2022-08-02 14:21:25 -07:00
dm-zoned-metadata.c - The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe 2022-08-05 16:32:45 -07:00
dm-zoned-reclaim.c dm kcopyd: avoid useless atomic operations 2021-06-04 12:07:24 -04:00
dm-zoned-target.c dm-zoned: cleanup dmz_fixup_devices 2022-07-06 06:46:26 -06:00
dm-zoned.h dm/dm-zoned: Use the enum req_op type 2022-07-14 12:14:31 -06:00
dm.c dm: remove unnecessary assignment statement in alloc_dev() 2022-10-29 10:08:34 +02:00
dm.h dm table: audit all dm_table_get_target() callers 2022-07-07 11:49:34 -04:00
md-autodetect.c md: return the allocated devices from md_alloc 2022-08-02 17:22:46 -06:00
md-bitmap.c fs/buffer: Combine two submit_bh() and ll_rw_block() arguments 2022-07-14 12:14:32 -06:00
md-bitmap.h
…
md-cluster.c md: Fix spelling mistake in comments 2022-08-02 17:14:44 -06:00
md-cluster.h
…
md-faulty.c block: pass a block_device to bio_clone_fast 2022-02-04 07:43:18 -07:00
md-linear.c md: remove most calls to bdevname 2022-05-22 23:07:21 -07:00
md-linear.h
…
md-multipath.c md: remove most calls to bdevname 2022-05-22 23:07:21 -07:00
md-multipath.h
…
md.c md: Remove extra mddev_get() in md_seq_start() 2022-10-21 12:38:48 +02:00
md.h md: return the allocated devices from md_alloc 2022-08-02 17:22:46 -06:00
raid0.c md: Replace snprintf with scnprintf 2022-10-21 12:38:47 +02:00
raid0.h
…
raid1-10.c md: raid1/raid10: drop pending_cnt 2022-03-08 15:16:54 -08:00
raid1.c md/raid1: Use the new blk_opf_t type 2022-07-14 12:14:31 -06:00
raid1.h md: raid1/raid10: drop pending_cnt 2022-03-08 15:16:54 -08:00
raid5-cache.c md/raid5-cache: Annotate pslot with __rcu notation 2022-08-02 17:14:32 -06:00
raid5-log.h md/raid5-ppl: Drop unused argument from ppl_handle_flush_request() 2022-08-02 17:14:31 -06:00
raid5-ppl.c md/raid5-ppl: Drop unused argument from ppl_handle_flush_request() 2022-08-02 17:14:31 -06:00
raid5.c md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d 2022-10-21 12:39:23 +02:00
raid5.h md/raid5: Ensure batch_last is released before sleeping for quiesce 2022-08-02 21:08:53 -06:00
raid10.c md/raid10: Fix the data type of an r10_sync_page_io() argument 2022-08-24 10:26:35 -07:00
raid10.h md: raid1/raid10: drop pending_cnt 2022-03-08 15:16:54 -08:00