]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
dm-ioctl: fix a possible overflow in list_version_get_info
authorMikulas Patocka <mpatocka@redhat.com>
Thu, 9 Jul 2026 19:31:47 +0000 (21:31 +0200)
committerMikulas Patocka <mpatocka@redhat.com>
Fri, 10 Jul 2026 12:40:51 +0000 (14:40 +0200)
commit76c6f845dc0c614304a6e6ee619b552f97cf24b3
tree5ecbae47ec8b8a22a98380c8b5e8cf50cca2c880
parent366665416f20527ff7cad548a32d1ddf23195740
dm-ioctl: fix a possible overflow in list_version_get_info

sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the
output buffer - info->vers->version[0], info->vers->version[1],
info->vers->version[2] and info->vers->next. This can cause buffer
overflow.

Fix this buffer overflow by replacing "sizeof(tt->version)" with
"sizeof(struct dm_target_versions)".

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-4.6
Cc: stable@vger.kernel.org
drivers/md/dm-ioctl.c