]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
dm ioctl: fix out of bounds array access when no devices
authorMikulas Patocka <mpatocka@redhat.com>
Fri, 26 Mar 2021 18:32:32 +0000 (14:32 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 22 May 2021 08:38:29 +0000 (10:38 +0200)
commit0c0f93fbd20276d65ae0581edfcdc93579aa1dc7
treef1e59328d2914c8ef13e34a5aa75d865564fef85
parentf763e65c10480e35d04f0b8d7d7e4646a1a593f1
dm ioctl: fix out of bounds array access when no devices

commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.

If there are not any dm devices, we need to zero the "dev" argument in
the first structure dm_name_list. However, this can cause out of
bounds write, because the "needed" variable is zero and len may be
less than eight.

Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
too small to hold the "nl->dev" value.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
[iwamatsu: Adjust context]
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/md/dm-ioctl.c