lkml.org 
[lkml]   [2019]   [Aug]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 52/62] dm table: fix invalid memory accesses with too high sector number
    Date
    From: Mikulas Patocka <mpatocka@redhat.com>

    commit 1cfd5d3399e87167b7f9157ef99daa0e959f395d upstream.

    If the sector number is too high, dm_table_find_target() should return a
    pointer to a zeroed dm_target structure (the caller should test it with
    dm_target_is_valid).

    However, for some table sizes, the code in dm_table_find_target() that
    performs btree lookup will access out of bound memory structures.

    Fix this bug by testing the sector number at the beginning of
    dm_table_find_target(). Also, add an "inline" keyword to the function
    dm_table_get_size() because this is a hot path.

    Fixes: 512875bd9661 ("dm: table detect io beyond device")
    Cc: stable@vger.kernel.org
    Reported-by: Zhang Tao <kontais@zoho.com>
    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/md/dm-table.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    --- a/drivers/md/dm-table.c
    +++ b/drivers/md/dm-table.c
    @@ -1308,7 +1308,7 @@ void dm_table_event(struct dm_table *t)
    }
    EXPORT_SYMBOL(dm_table_event);

    -sector_t dm_table_get_size(struct dm_table *t)
    +inline sector_t dm_table_get_size(struct dm_table *t)
    {
    return t->num_targets ? (t->highs[t->num_targets - 1] + 1) : 0;
    }
    @@ -1333,6 +1333,9 @@ struct dm_target *dm_table_find_target(s
    unsigned int l, n = 0, k = 0;
    sector_t *node;

    + if (unlikely(sector >= dm_table_get_size(t)))
    + return &t->targets[t->num_targets];
    +
    for (l = 0; l < t->depth; l++) {
    n = get_child(n, k);
    node = get_node(t, l, n);

    \
     
     \ /
      Last update: 2019-08-27 09:55    [W:7.955 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site