]> git.baikalelectronics.ru Git - kernel.git/commit
dm ioctl: fix out of bounds array access when no devices
authorMikulas Patocka <mpatocka@redhat.com>
Fri, 26 Mar 2021 18:32:32 +0000 (14:32 -0400)
committerMike Snitzer <snitzer@redhat.com>
Fri, 26 Mar 2021 18:51:50 +0000 (14:51 -0400)
commit77cdabac1da431d4e726069e68cd6da90dfd269b
treeacb59de82e8576d658a2a2eb47b520c126f87ebd
parent706e82e0178b1e2291b26a125f3e61b0316066f3
dm ioctl: fix out of bounds array access when no devices

If there are not any dm devices, we need to zero the "dev" argument in
the first structure dm_name_list. However, this can cause out of
bounds write, because the "needed" variable is zero and len may be
less than eight.

Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
too small to hold the "nl->dev" value.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
drivers/md/dm-ioctl.c