Skip to contentSkip to conversation

dm ioctl: fix out of bounds array access when no devices

PATCH In review Ard Biesheuvel 2 participants 3 messages May 19, 2021

Subsystems (2)
Stable branch Device mapper
lore
Share & tools
lore

Ard Biesheuvel

author
#0 lore raw

PATCH 1/1 dm ioctl: fix out of bounds array access when no devices

From: Mikulas Patocka <[email protected]>

commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.

If there are not any dm devices, we need to zero the "dev" argument in the first structure dm_name_list. However, this can cause out of bounds write, because the "needed" variable is zero and len may be less than eight.

Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is too small to hold the "nl->dev" value.

Signed-off-by Mikulas Patocka <[email protected]>
Reported-by Dan Carpenter <[email protected]>
Cc [email protected]
Signed-off-by Mike Snitzer <[email protected]>
Signed-off-by Ard Biesheuvel <[email protected]>

---
Please apply to 4.4.y and 4.9.y

 drivers/md/dm-ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-ioctl.c +1 -1
index 836a2808c0c7..eb2659a12310 100644
@@ -524,7 +524,7 @@ static int list_devices(struct dm_ioctl *param, size_t param_size)
 	 * Grab our output buffer.
 	 */
 	nl = get_result_buffer(param, param_size, &len);
-	if (len < needed) {
+	if (len < needed || len < sizeof(nl->dev)) {
 		param->flags |= DM_BUFFER_FULL_FLAG;
 		goto out;
 	}
Signature · 1 line
2.20.1
maintainer
#1 lore raw
Quoted 12 lines · Ard Biesheuvel

From: Mikulas Patocka <[email protected]>

commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.

If there are not any dm devices, we need to zero the "dev" argument in the first structure dm_name_list. However, this can cause out of bounds write, because the "needed" variable is zero and len may be less than eight.

Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is too small to hold the "nl->dev" value.

Quoted 7 lines
Signed-off-by Mikulas Patocka <[email protected]>
Reported-by Dan Carpenter <[email protected]>
Cc [email protected]
Signed-off-by Mike Snitzer <[email protected]>
Signed-off-by Ard Biesheuvel <[email protected]>

---
Please apply to 4.4.y and 4.9.y

We already carry this patch via the backport provided in
https://lore.kernel.org/stable/[email protected]/

Signature · 2 lines
Thanks,
Sasha
author
#2 lore raw
Quoted 22 lines · Sasha Levin
Quoted 12 lines · Ard Biesheuvel

From: Mikulas Patocka <[email protected]>

commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.

If there are not any dm devices, we need to zero the "dev" argument in the first structure dm_name_list. However, this can cause out of bounds write, because the "needed" variable is zero and len may be less than eight.

Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is too small to hold the "nl->dev" value.

Quoted 7 lines
Signed-off-by Mikulas Patocka <[email protected]>
Reported-by Dan Carpenter <[email protected]>
Cc [email protected]
Signed-off-by Mike Snitzer <[email protected]>
Signed-off-by Ard Biesheuvel <[email protected]>

---
Please apply to 4.4.y and 4.9.y

Quoted 3 lines

We already carry this patch via the backport provided in
https://lore.kernel.org/stable/[email protected]/

Excellent, thanks.