]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
dm-verity-fec: correctly reject too-small hash devices
authorEric Biggers <ebiggers@kernel.org>
Fri, 6 Feb 2026 04:59:21 +0000 (20:59 -0800)
committerMikulas Patocka <mpatocka@redhat.com>
Mon, 9 Mar 2026 14:10:58 +0000 (15:10 +0100)
Fix verity_fec_ctr() to reject too-small hash devices by correctly
taking hash_start into account.

Note that this is necessary because dm-verity doesn't call
dm_bufio_set_sector_offset() on the hash device's bufio client
(v->bufio).  Thus, dm_bufio_get_device_size(v->bufio) returns a size
relative to 0 rather than hash_start.  An alternative fix would be to
call dm_bufio_set_sector_offset() on v->bufio, but then all the code
that reads from the hash device would have to be adjusted accordingly.

Fixes: a739ff3f543a ("dm verity: add support for forward error correction")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
drivers/md/dm-verity-fec.c

index 9d5dace7d4200f45c2aed9dbd36bc557082b7124..721b7c377386e97efa671c847db809a5063bf592 100644 (file)
@@ -688,7 +688,8 @@ int verity_fec_ctr(struct dm_verity *v)
         * it to be large enough.
         */
        f->hash_blocks = f->blocks - v->data_blocks;
-       if (dm_bufio_get_device_size(v->bufio) < f->hash_blocks) {
+       if (dm_bufio_get_device_size(v->bufio) <
+           v->hash_start + f->hash_blocks) {
                ti->error = "Hash device is too small for "
                        DM_VERITY_OPT_FEC_BLOCKS;
                return -E2BIG;