releases/4.19.35/dm-integrity-change-memcmp-to-strncmp-in-dm_integrity_ctr.patch

   1 From 0d74e6a3b6421d98eeafbed26f29156d469bc0b5 Mon Sep 17 00:00:00 2001
   2 From: Mikulas Patocka <mpatocka@redhat.com>
   3 Date: Wed, 13 Mar 2019 07:56:02 -0400
   4 Subject: dm integrity: change memcmp to strncmp in dm_integrity_ctr
   5
   6 From: Mikulas Patocka <mpatocka@redhat.com>
   7
   8 commit 0d74e6a3b6421d98eeafbed26f29156d469bc0b5 upstream.
   9
  10 If the string opt_string is small, the function memcmp can access bytes
  11 that are beyond the terminating nul character. In theory, it could cause
  12 segfault, if opt_string were located just below some unmapped memory.
  13
  14 Change from memcmp to strncmp so that we don't read bytes beyond the end
  15 of the string.
  16
  17 Cc: stable@vger.kernel.org # v4.12+
  18 Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
  19 Signed-off-by: Mike Snitzer <snitzer@redhat.com>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21
  22 ---
  23  drivers/md/dm-integrity.c |    8 ++++----
  24  1 file changed, 4 insertions(+), 4 deletions(-)
  25
  26 --- a/drivers/md/dm-integrity.c
  27 +++ b/drivers/md/dm-integrity.c
  28 @@ -3174,7 +3174,7 @@ static int dm_integrity_ctr(struct dm_ta
  29                         journal_watermark = val;
  30                 else if (sscanf(opt_string, "commit_time:%u%c", &val, &dummy) == 1)
  31                         sync_msec = val;
  32 -               else if (!memcmp(opt_string, "meta_device:", strlen("meta_device:"))) {
  33 +               else if (!strncmp(opt_string, "meta_device:", strlen("meta_device:"))) {
  34                         if (ic->meta_dev) {
  35                                 dm_put_device(ti, ic->meta_dev);
  36                                 ic->meta_dev = NULL;
  37 @@ -3193,17 +3193,17 @@ static int dm_integrity_ctr(struct dm_ta
  38                                 goto bad;
  39                         }
  40                         ic->sectors_per_block = val >> SECTOR_SHIFT;
  41 -               } else if (!memcmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
  42 +               } else if (!strncmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
  43                         r = get_alg_and_key(opt_string, &ic->internal_hash_alg, &ti->error,
  44                                             "Invalid internal_hash argument");
  45                         if (r)
  46                                 goto bad;
  47 -               } else if (!memcmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
  48 +               } else if (!strncmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
  49                         r = get_alg_and_key(opt_string, &ic->journal_crypt_alg, &ti->error,
  50                                             "Invalid journal_crypt argument");
  51                         if (r)
  52                                 goto bad;
  53 -               } else if (!memcmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
  54 +               } else if (!strncmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
  55                         r = get_alg_and_key(opt_string, &ic->journal_mac_alg,  &ti->error,
  56                                             "Invalid journal_mac argument");
  57                         if (r)