From: Mikulas Patocka <mpatocka@redhat.com>
Date: Fri, 14 Mar 2025 12:51:32 +0000 (+0100)
Subject: dm: restrict dm device size to 2^63-512 bytes
X-Git-Tag: v6.14.9~600
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=75ecd71f9ff1e67fd4f6031ff76a2c529ee8d7f5;p=thirdparty%2Fkernel%2Fstable.git

dm: restrict dm device size to 2^63-512 bytes

[ Upstream commit 45fc728515c14f53f6205789de5bfd72a95af3b8 ]

The devices with size >= 2^63 bytes can't be used reliably by userspace
because the type off_t is a signed 64-bit integer.

Therefore, we limit the maximum size of a device mapper device to
2^63-512 bytes.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index efc6ec25e0c5d..4752966fdb3f4 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -698,6 +698,10 @@ int dm_table_add_target(struct dm_table *t, const char *type,
 		DMERR("%s: zero-length target", dm_device_name(t->md));
 		return -EINVAL;
 	}
+	if (start + len < start || start + len > LLONG_MAX >> SECTOR_SHIFT) {
+		DMERR("%s: too large device", dm_device_name(t->md));
+		return -EINVAL;
+	}
 
 	ti->type = dm_get_target_type(type);
 	if (!ti->type) {