Skip to contentSkip to conversation

Patch "dm verity fec: limit error correction recursion" has been added to the 4.10-stable tree

PATCH [email protected] 1 participant 1 message Apr 10, 2017

Subsystems (2)
Stable branch Device mapper
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

dm verity fec: limit error correction recursion

to the 4.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
dm-verity-fec-limit-error-correction-recursion.patch
and it can be found in the queue-4.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From f1a880a93baaadb14c10a348fd199f1cdb6bcccd Mon Sep 17 00:00:00 2001

From: Sami Tolvanen <[email protected]>
Date: Wed, 15 Mar 2017 15:12:23 -0700
Subject: dm verity fec: limit error correction recursion

From: Sami Tolvanen <[email protected]>

commit f1a880a93baaadb14c10a348fd199f1cdb6bcccd upstream.

If the hash tree itself is sufficiently corrupt in addition to data blocks, it's possible for error correction to end up in a deep recursive loop, which eventually causes a kernel panic. This change limits the recursion to a reasonable level during a single I/O operation.

Fixes a739ff3f543a ("dm verity: add support for forward error correction")
Signed-off-by Sami Tolvanen <[email protected]>
Signed-off-by Mike Snitzer <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/md/dm-verity-fec.c |   12 +++++++++++-
 drivers/md/dm-verity-fec.h |    4 ++++
 2 files changed, 15 insertions(+), 1 deletion(-)
drivers/md/dm-verity-fec.c +11 -1
@@ -439,6 +439,13 @@ int verity_fec_decode(struct dm_verity *
 	if (!verity_fec_is_enabled(v))
 		return -EOPNOTSUPP;
 
+	if (fio->level >= DM_VERITY_FEC_MAX_RECURSION) {
+		DMWARN_LIMIT("%s: FEC: recursion too deep", v->data_dev->name);
+		return -EIO;
+	}
+
+	fio->level++;
+
 	if (type == DM_VERITY_BLOCK_TYPE_METADATA)
 		block += v->data_blocks;
 

@@ -470,7 +477,7 @@ int verity_fec_decode(struct dm_verity *
 	if (r < 0) {
 		r = fec_decode_rsb(v, io, fio, rsb, offset, true);
 		if (r < 0)
-			return r;
+			goto done;
 	}
 
 	if (dest)

@@ -480,6 +487,8 @@ int verity_fec_decode(struct dm_verity *
 		r = verity_for_bv_block(v, io, iter, fec_bv_copy);
 	}
 
+done:
+	fio->level--;
 	return r;
 }
 

@@ -520,6 +529,7 @@ void verity_fec_init_io(struct dm_verity
 	memset(fio->bufs, 0, sizeof(fio->bufs));
 	fio->nbufs = 0;
 	fio->output = NULL;
+	fio->level = 0;
 }
 
 /*
drivers/md/dm-verity-fec.h +4 -0
@@ -27,6 +27,9 @@
 #define DM_VERITY_FEC_BUF_MAX \
 	(1 << (PAGE_SHIFT - DM_VERITY_FEC_BUF_RS_BITS))
 
+/* maximum recursion level for verity_fec_decode */
+#define DM_VERITY_FEC_MAX_RECURSION	4
+
 #define DM_VERITY_OPT_FEC_DEV		"use_fec_from_device"
 #define DM_VERITY_OPT_FEC_BLOCKS	"fec_blocks"
 #define DM_VERITY_OPT_FEC_START		"fec_start"

@@ -58,6 +61,7 @@ struct dm_verity_fec_io {
 	unsigned nbufs;		/* number of buffers allocated */
 	u8 *output;		/* buffer for corrected output */
 	size_t output_pos;
+	unsigned level;		/* recursion level */
 };
 
 #ifdef CONFIG_DM_VERITY_FEC

Patches currently in stable-queue which might be from [email protected] are

queue-4.10/dm-verity-fec-fix-bufio-leaks.patch queue-4.10/dm-verity-fec-limit-error-correction-recursion.patch