1 From 0d74e6a3b6421d98eeafbed26f29156d469bc0b5 Mon Sep 17 00:00:00 2001
2 From: Mikulas Patocka <mpatocka@redhat.com>
3 Date: Wed, 13 Mar 2019 07:56:02 -0400
4 Subject: dm integrity: change memcmp to strncmp in dm_integrity_ctr
6 From: Mikulas Patocka <mpatocka@redhat.com>
8 commit 0d74e6a3b6421d98eeafbed26f29156d469bc0b5 upstream.
10 If the string opt_string is small, the function memcmp can access bytes
11 that are beyond the terminating nul character. In theory, it could cause
12 segfault, if opt_string were located just below some unmapped memory.
14 Change from memcmp to strncmp so that we don't read bytes beyond the end
17 Cc: stable@vger.kernel.org # v4.12+
18 Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
19 Signed-off-by: Mike Snitzer <snitzer@redhat.com>
20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
23 drivers/md/dm-integrity.c | 8 ++++----
24 1 file changed, 4 insertions(+), 4 deletions(-)
26 --- a/drivers/md/dm-integrity.c
27 +++ b/drivers/md/dm-integrity.c
28 @@ -3174,7 +3174,7 @@ static int dm_integrity_ctr(struct dm_ta
29 journal_watermark = val;
30 else if (sscanf(opt_string, "commit_time:%u%c", &val, &dummy) == 1)
32 - else if (!memcmp(opt_string, "meta_device:", strlen("meta_device:"))) {
33 + else if (!strncmp(opt_string, "meta_device:", strlen("meta_device:"))) {
35 dm_put_device(ti, ic->meta_dev);
37 @@ -3193,17 +3193,17 @@ static int dm_integrity_ctr(struct dm_ta
40 ic->sectors_per_block = val >> SECTOR_SHIFT;
41 - } else if (!memcmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
42 + } else if (!strncmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
43 r = get_alg_and_key(opt_string, &ic->internal_hash_alg, &ti->error,
44 "Invalid internal_hash argument");
47 - } else if (!memcmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
48 + } else if (!strncmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
49 r = get_alg_and_key(opt_string, &ic->journal_crypt_alg, &ti->error,
50 "Invalid journal_crypt argument");
53 - } else if (!memcmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
54 + } else if (!strncmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
55 r = get_alg_and_key(opt_string, &ic->journal_mac_alg, &ti->error,
56 "Invalid journal_mac argument");