dm-ioctl: fix a possible overflow in list_version_get_info

sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the
output buffer - info->vers->version[0], info->vers->version[1],
info->vers->version[2] and info->vers->next. This can cause buffer
overflow.

Fix this buffer overflow by replacing "sizeof(tt->version)" with
"sizeof(struct dm_target_versions)".

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-4.6
Cc: stable@vger.kernel.org

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 1fa8bf835be06ac87bffec547ad55a7c0eba7fdb..61af2a437a050856565f4da5d7a131010cbaf409 100644 (file)
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -785,7 +785,7 @@ static void list_version_get_info(struct target_type *tt, void *param)
        struct vers_iter *info = param;
 
        /* Check space - it might have changed since the first iteration */
-       if ((char *)info->vers + sizeof(tt->version) + strlen(tt->name) + 1 > info->end) {
+       if ((char *)info->vers + sizeof(struct dm_target_versions) + strlen(tt->name) + 1 > info->end) {
                info->flags = DM_BUFFER_FULL_FLAG;
                return;
        }