From patchwork Thu Jun 1 21:24:50 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Demi Marie Obenour X-Patchwork-Id: 102189 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp622154vqr; Thu, 1 Jun 2023 14:26:28 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7xwiiQhfTedQooakdl4ivPHu7eOJRXfhE5K88VIVqAuWXAeNSqcO1StFMXLI2CZhklK/gS X-Received: by 2002:a92:6a01:0:b0:335:25e7:1897 with SMTP id f1-20020a926a01000000b0033525e71897mr6263793ilc.32.1685654788066; Thu, 01 Jun 2023 14:26:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685654788; cv=none; d=google.com; s=arc-20160816; b=sCCDtIs9RKYoAsOUbeccuMEkdmHGR7yOv2q8e5IG+8j2/8RB0SqO4t4gtPlv5htpFT ZzvvBrLUBjtytNew8CsS4q1Gcs/drYPeCAfyu39WeMXJyAIyeng5Y5AghJbHHaswFVaE GD4cnsMQhKhH5gDTl+4yVUeTjJQNy41mOf5mUaZWE9nuFuRT2Yr3PaiAkxRRf6unuERe yAZBLK54mh9Z5X0hRVJLm0x2vUxhQLlXnQtvuR/MhwhD8idQtH9WLx5a72V1b1XrjMoW j1Enos4wU6pG+92uy+j6RTe5IqC6uXU2YfcH/04C91cvtKKiHYtqH08caosTZqAlUCwb fD2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=YCzACzClxGa/ktYTHwJaaNWjaN7phPISbw1cPfpWZUo=; b=ueI7Qhgp9ceo4Cb1auFQn69K8FFVTw53WkVuPqSv8kvYCgDZOUs7an5U3xOMrFUwri 5Lw2ch0e21tkRFWt7tCDe5n32Vqq7cCqpNltrfEbbOwqkCbkLlZKgzJPF7xwG0tGqMwL 0xluBfwZMdOT/WUnm85cr7tpgA8td7m9X+v/gk0Rqr4sn7pgiNEWlB6HGr6eAYQjFD9P JcwcmwcjwzFF6DYKqTz6ipqEKqPaSdFb6uq8AeESWfFlxTAhEWex9TN6U2LQxlmI6s0U N4KweDXw4vw/mU+aFL/bpJh5lJoI3DHbvLN2irWeQwKcSuGT5MH5HT504GQqlfo3BeGX WGIA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=Yow1Rwdf; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=NyUnBK+5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id e9-20020a636909000000b0050bd71e8618si783194pgc.848.2023.06.01.14.26.13; Thu, 01 Jun 2023 14:26:28 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=Yow1Rwdf; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=NyUnBK+5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231558AbjFAVZW (ORCPT + 99 others); Thu, 1 Jun 2023 17:25:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45664 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229554AbjFAVZR (ORCPT ); Thu, 1 Jun 2023 17:25:17 -0400 Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B933F196; Thu, 1 Jun 2023 14:25:16 -0700 (PDT) Received: from compute2.internal (compute2.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id 308695C01D5; Thu, 1 Jun 2023 17:25:16 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute2.internal (MEProxy); Thu, 01 Jun 2023 17:25:16 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to; s=fm1; t=1685654716; x=1685741116; bh=YCzACzClxG a/ktYTHwJaaNWjaN7phPISbw1cPfpWZUo=; b=Yow1RwdfcCR7QVK1I2IfI5kT+G 6A5aRNuZHN+dx4ifLPyv2d3v2R0GduuZCBSdHKmgS/m+GhNW3BvaPzbZ+U6WnM/f rgBbrybs0D3VMAgqza08vUvDmQRkOgum/90REHRP1dTaJ2f+coP+CpST89r8ENe9 FWA3JMY0ulvPqmSox62Rg0n84Ng0zFb1yOJoiiJI3/FI9E9U5zCLkYhS+pWqq4fu 28mNw6y5S4dLK4kWJv2tBEH50CQM8nbwdufZX9uZbYj2XwtHTE40Yzfmyy+tNYCP Lph5PXpNR/nDbxYefx4fZrm+Or/Ae6z5vsZktOoq5opqjvMX/7NiCceZetkA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t=1685654716; x= 1685741116; bh=YCzACzClxGa/ktYTHwJaaNWjaN7phPISbw1cPfpWZUo=; b=N yUnBK+5umNQE4gkH8ZRIQSupXiK6IgaOEfWtGj5fBmK3MdhlCcEOz3J1FS2ifIXy aXv25JePjIbEF7CTwIvZBwOU+VzGN9/p2LvRtd/kD5PrKXguZh6tVgYSAv4VEMN0 XQV3HTD/WCQZKmcBKZVMgHKX3wb3gCZXs4x/9sdd5GaMoV7n0xSGbUJw5is7571K 9ne1u78HwBavBlV9xVL+eiPPb7hu7B9kqCe28WUsgewk43aXnUknaTAW8kF6qOvF 9KjF+9CTOr9SpyNqOoVBJ8nIlBRcKRk9zDzrCa34We8N9Siz7EmAn9mDa+EHmu3y gMrMryjCv+dB7UCvFoKIw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrfeeluddgudeitdcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefhvfevufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffvghm ihcuofgrrhhivgcuqfgsvghnohhurhcuoeguvghmihesihhnvhhishhisghlvghthhhinh hgshhlrggsrdgtohhmqeenucggtffrrghtthgvrhhnpeejffejgffgueegudevvdejkefg hefghffhffejteekleeufeffteffhfdtudehteenucevlhhushhtvghrufhiiigvpedtne curfgrrhgrmhepmhgrihhlfhhrohhmpeguvghmihesihhnvhhishhisghlvghthhhinhhg shhlrggsrdgtohhm X-ME-Proxy: Feedback-ID: iac594737:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 1 Jun 2023 17:25:15 -0400 (EDT) From: Demi Marie Obenour To: Alasdair Kergon , Mike Snitzer , dm-devel@redhat.com Cc: Demi Marie Obenour , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 1/6] device-mapper: Check that target specs are sufficiently aligned Date: Thu, 1 Jun 2023 17:24:50 -0400 Message-Id: <20230601212456.1533-2-demi@invisiblethingslab.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230601212456.1533-1-demi@invisiblethingslab.com> References: <20230601212456.1533-1-demi@invisiblethingslab.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767537155071946148?= X-GMAIL-MSGID: =?utf-8?q?1767537155071946148?= Otherwise subsequent code will dereference a misaligned `struct dm_target_spec *`, which is undefined behavior. Signed-off-by: Demi Marie Obenour Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org --- drivers/md/dm-ioctl.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index cc77cf3d410921432eb0c62cdede7d55b9aa674a..34fa74c6a70db8aa67aaba3f6a2fc4f38ef736bc 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1394,6 +1394,13 @@ static inline fmode_t get_mode(struct dm_ioctl *param) static int next_target(struct dm_target_spec *last, uint32_t next, void *end, struct dm_target_spec **spec, char **target_params) { + static_assert(_Alignof(struct dm_target_spec) <= 8, + "struct dm_target_spec has excessive alignment requirements"); + if (next % 8) { + DMERR("Next target spec (offset %u) is not 8-byte aligned", next); + return -EINVAL; + } + *spec = (struct dm_target_spec *) ((unsigned char *) last + next); *target_params = (char *) (*spec + 1); From patchwork Thu Jun 1 21:24:51 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Demi Marie Obenour X-Patchwork-Id: 102190 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp624335vqr; Thu, 1 Jun 2023 14:31:00 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7afD95l+bnhojoZ3yidq9jsS2+2UUQcc2cP/VxY+GuRoUd86chtuokw8nGsooy/Jcv0nWq X-Received: by 2002:a05:6358:7e90:b0:123:5465:9284 with SMTP id o16-20020a0563587e9000b0012354659284mr6947509rwn.4.1685655060264; Thu, 01 Jun 2023 14:31:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685655060; cv=none; d=google.com; s=arc-20160816; b=MS/2W0jNB9lRas0UdbMNdbmbcNFCI026wZCttw8no91Uj3xRWJgdFqPSFWqgZrgt87 2vyRWKePU4060k1YWigg3qJI3GrpwkJVR54rV0FFQ8pEjPnHQ99nrCUKVxHCwhRJEeLj An/Fh3IcZuyvP5OdUYWMg7SSw51JIGE3MmY8sTCjPJa3+lcvAU7Z9mxjP09Qc+KITa2T PTjQ/fgRyw6Onx3tB7l4OQCeNDqndm8PyFavMzi3k47PMtUKqSMLm1VwlFmWtqbOBHCn HPINNTm28c2LFH2W7euCEZctrhyJjNBHt/tr3G3JeirwtnN+ntIqAFYGpTu6eLehw8+4 t39g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=aSjkzE25S8BxmyJfHmxx2kjK812O0BGlmJS9UYp63Y4=; b=q7yzxwuKNJzMRszeiBXWmnsj53t6oCdwFzSNTKQ+rMK/s8iI3llsKEV85dNlBSkgnl 8U5WJayYZiDEXhToBZZiJDgjV/6Q2bJBOdFnLNp7dRrir6cVr/ce/Z+IHd+sg5ZywhSj VfTUSZrdx+1hdYm4DM6WjMwZMuF1kQ2pp+WRl3BzY3QfoTJdTxdtv+8aplX07qr6cybP 4fwK/d7hQFTZvvnQ83JcdR1JLDzg2cjoOs7MczGabvBF4mX3IREZEKFprY5kk+94b8Z2 Sa4M47Ah7gcrf+lGk3uSKLJPujM5HprVLJevoAMjoSlyQAIPe2+0O+1+T3MLPMfauNsw jrgw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=l1QRMld4; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=dF7DfCZG; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id p30-20020a637f5e000000b0053f094848e1si3337758pgn.402.2023.06.01.14.30.46; Thu, 01 Jun 2023 14:31:00 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=l1QRMld4; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=dF7DfCZG; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231680AbjFAVZY (ORCPT + 99 others); Thu, 1 Jun 2023 17:25:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45674 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231346AbjFAVZT (ORCPT ); Thu, 1 Jun 2023 17:25:19 -0400 Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 19B3B184; Thu, 1 Jun 2023 14:25:18 -0700 (PDT) Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id 85EE95C01DB; Thu, 1 Jun 2023 17:25:17 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute5.internal (MEProxy); Thu, 01 Jun 2023 17:25:17 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to; s=fm1; t=1685654717; x=1685741117; bh=aSjkzE25S8 BxmyJfHmxx2kjK812O0BGlmJS9UYp63Y4=; b=l1QRMld4HT61hs5D/NwPdFVT8i oLYi6LDHCqiBkgvcqQXsObJksonX1R1o0vJzWl5xO8LQpP66ixDBpNT+xKcYinHa 5gEutmzEBfhG9wbnq7gIuhJx7/m06WFwH9VKZyMZQl75wNr6tWNxZvRrBPuJ3WBU tSTOetyK7AML5Bdtm/k6YR3rL3V5pPxAsuisQtEuD0NikrdzPvQ31rh4icqmuKNe 1tnlcwk89P3puxhb4vgTQlSpzjWMsp4aPWAijOfbdNkPq8sNWTqz8kavYLZKdqEc TFNNV3U69HP9aKyik46iO8LpjGMN9t6bhM232FzLpsIRzD7qA+MSfFnMkkpA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t=1685654717; x= 1685741117; bh=aSjkzE25S8BxmyJfHmxx2kjK812O0BGlmJS9UYp63Y4=; b=d F7DfCZGlFoFRWdE4a0L4fK8mg1yy7Xj2devYGeeWHz12mMNDZcdG2gVhM2uLpa8o 87MPBdZW18Tj0BNrvZZaSQzUlzJp+VZwGw5crlSVzU1OZuKsSrieNijJG4JVIlEJ Ca9zONBGWxs35RtWYiG59IK5iE3jyRes2HUj4slcJoASX+q9uqreiUIy/bdtSNYO CvIE3Bc6Q3mIJZn4sieEGmsOEVfRlUtXTQxRfbsFbuFi0eEKWlyIP1+qQr85dD1i rPLvLy5JlrJqOPGLTT2uYATtLjqMScRR83owCkU5o56gAGpUqLPskVs2IEj+gkJy tCyy0acVlqNfyPM0nMYXw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrfeeluddgudeiudcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefhvfevufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffvghm ihcuofgrrhhivgcuqfgsvghnohhurhcuoeguvghmihesihhnvhhishhisghlvghthhhinh hgshhlrggsrdgtohhmqeenucggtffrrghtthgvrhhnpeejffejgffgueegudevvdejkefg hefghffhffejteekleeufeffteffhfdtudehteenucevlhhushhtvghrufhiiigvpedtne curfgrrhgrmhepmhgrihhlfhhrohhmpeguvghmihesihhnvhhishhisghlvghthhhinhhg shhlrggsrdgtohhm X-ME-Proxy: Feedback-ID: iac594737:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 1 Jun 2023 17:25:16 -0400 (EDT) From: Demi Marie Obenour To: Alasdair Kergon , Mike Snitzer , dm-devel@redhat.com Cc: Demi Marie Obenour , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 2/6] device-mapper: Avoid pointer arithmetic overflow Date: Thu, 1 Jun 2023 17:24:51 -0400 Message-Id: <20230601212456.1533-3-demi@invisiblethingslab.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230601212456.1533-1-demi@invisiblethingslab.com> References: <20230601212456.1533-1-demi@invisiblethingslab.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767537440509240946?= X-GMAIL-MSGID: =?utf-8?q?1767537440509240946?= Especially on 32-bit systems, it is possible for the pointer arithmetic to overflow and cause a userspace pointer to be dereferenced in the kernel. Signed-off-by: Demi Marie Obenour Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org --- drivers/md/dm-ioctl.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 34fa74c6a70db8aa67aaba3f6a2fc4f38ef736bc..64e8f16d344c47057de5e2d29e3d63202197dca0 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1396,6 +1396,25 @@ static int next_target(struct dm_target_spec *last, uint32_t next, void *end, { static_assert(_Alignof(struct dm_target_spec) <= 8, "struct dm_target_spec has excessive alignment requirements"); + static_assert(offsetof(struct dm_ioctl, data) >= sizeof(struct dm_target_spec), + "struct dm_target_spec too big"); + + /* + * Number of bytes remaining, starting with last. This is always + * sizeof(struct dm_target_spec) or more, as otherwise *last was + * out of bounds already. + */ + size_t remaining = (char *)end - (char *)last; + + /* + * There must be room for both the next target spec and the + * NUL-terminator of the target itself. + */ + if (remaining - sizeof(struct dm_target_spec) <= next) { + DMERR("Target spec extends beyond end of parameters"); + return -EINVAL; + } + if (next % 8) { DMERR("Next target spec (offset %u) is not 8-byte aligned", next); return -EINVAL; From patchwork Thu Jun 1 21:24:52 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Demi Marie Obenour X-Patchwork-Id: 102194 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp626515vqr; Thu, 1 Jun 2023 14:35:39 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7hB4vDE8LUYziC9c/OpVNQTfnFqbjuYpHZzpHvHUtOg/Sk200MDBwufYxH/fZbF0wXWP1y X-Received: by 2002:a17:902:9f8e:b0:1ac:482e:ed4d with SMTP id g14-20020a1709029f8e00b001ac482eed4dmr495535plq.18.1685655339554; Thu, 01 Jun 2023 14:35:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685655339; cv=none; d=google.com; s=arc-20160816; b=kQ1+2N2Wn5gNhrEnCvh1ffaH647pOdvFUViTI8IuVRiYzaXR9J3PALGzIbwXNVphKZ 5CMxTmIJQrSjgycVvVqLXLGebSesgeowGpYsZCmP3vofEfcK0DF5Th0iMbI5Ivyou0dw m7gUcViSSpApUuOa6IXkoJqZD4cdDmhxtPrltEJyChkaiKZaWN/7l6zACE/k4+axIh/3 QS1V4HfVag+xl4mhb2wU6Wi+qwYwvUHHAWA7gUCdIVLlYnM1UxqAzyd8NbIWQ2z81hos fZALgVhdVMiJlepzWk/gmuWR3j4pzA2XIlrABGC5rMBMUf1UipoCoA+UJhTRmsgYaBCY ZEcg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=YZHd7YYjlDK6sv+mkKSJgYpLNyemRttpNw5QnchM4bE=; b=bRjjrWQspVrYvyoEJ8XI+NU/Syve88UPHxWJy2HHo5ARGlDEG9yNEDrxjYo4c12EsF IZ6RavFnO0yrshvQgs9jGbbii9OmlWAKlMAMLeaqsOEMu2tai6QTwN3QixFuDPQpbVs7 jW7XxFvQAHX6CQz6xtxZI0+RgwPill16CIgWrlZJpFZbD2heyNSpTTQtVsvj/5LYlW7/ lcngFS1d7PlU4U0XfI2Y76pyanUJDiHSHhjtQ1dDQjr5WBY6unKpuyJjxnYOqU7nc3// H0ufEHiRl6OpRkbWyHLPkpJK0uoP06hZS1DWp2ZwLbvRxKeDcK8rKpRygNtDN21L7O+w QHaQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=kS5wGTsh; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=BjqUds5O; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id i12-20020a170902c94c00b001a647aadbe0si3420841pla.568.2023.06.01.14.35.28; Thu, 01 Jun 2023 14:35:39 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=kS5wGTsh; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=BjqUds5O; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231856AbjFAVZ1 (ORCPT + 99 others); Thu, 1 Jun 2023 17:25:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45682 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231499AbjFAVZU (ORCPT ); Thu, 1 Jun 2023 17:25:20 -0400 Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8B7B6196; Thu, 1 Jun 2023 14:25:19 -0700 (PDT) Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id ED3F95C01D0; Thu, 1 Jun 2023 17:25:18 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Thu, 01 Jun 2023 17:25:18 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to; s=fm1; t=1685654718; x=1685741118; bh=YZHd7YYjlD K6sv+mkKSJgYpLNyemRttpNw5QnchM4bE=; b=kS5wGTshap2i++C5h1+TcSncc2 FyNT5Ls4NghWOFzLklCX4jfQm1SrfiXo66GC2isWcdxhTthn0WyMAHJaWEIeAz+d BeX9M9RDPL9Y32OquGNX3RVXOvnLAhrGYDV+GrhQoe7w6g3Bo4YXRwDHWmbrjnY0 WNNLkrPKPXI5Q74v546DBQ2iNrddhKnRHV9xPTCveDoRefQPpBU4KmQqdG48oJ/6 G/W62z6gUVGPcamLkxaQUnvUXev+4NevkSbPwuH+6MD7sjFaBPbCTNg13yhHJ2EZ 7tdxmXFToLqpFMwqVK6xCQjEK7EwvWniq9DdGBOQLTmBrufHLPxrPaSi6FAQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t=1685654718; x= 1685741118; bh=YZHd7YYjlDK6sv+mkKSJgYpLNyemRttpNw5QnchM4bE=; b=B jqUds5OJLEiOrCvY8DDYia28d8+AGuiTY0nV6LPPKaTx+2zjEBJoQsS49+hlmZjI CCTkhS56YM2FuYbq7EQm58qze9jCa9ZEs/C13ZOvxaTI9Tl8pbvJ/knc4WZznSHQ MtZATudiq2KU6e7ye3tVGSloyyUNvbAW4ELQtPc0M/qLLs3q2CaW1WRBau8g0Zvz wwGCKiBv9yz6zE7qcgA3i62dbnnrgrNXScb/hXZjeWqxGtz9+SC7jIZY8C9L9uu1 Ydnv/N9NaPZM3jBZJ3mozb75d8Nt6Lv4EhXSHAlAXkNYFIosfaC3dGicb470Oi98 r+T0c9ScG7TQmBXyjXHMQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrfeeluddgudeiudcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefhvfevufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffvghm ihcuofgrrhhivgcuqfgsvghnohhurhcuoeguvghmihesihhnvhhishhisghlvghthhhinh hgshhlrggsrdgtohhmqeenucggtffrrghtthgvrhhnpeejffejgffgueegudevvdejkefg hefghffhffejteekleeufeffteffhfdtudehteenucevlhhushhtvghrufhiiigvpedtne curfgrrhgrmhepmhgrihhlfhhrohhmpeguvghmihesihhnvhhishhisghlvghthhhinhhg shhlrggsrdgtohhm X-ME-Proxy: Feedback-ID: iac594737:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 1 Jun 2023 17:25:18 -0400 (EDT) From: Demi Marie Obenour To: Alasdair Kergon , Mike Snitzer , dm-devel@redhat.com Cc: Demi Marie Obenour , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 3/6] device-mapper: structs and parameter strings must not overlap Date: Thu, 1 Jun 2023 17:24:52 -0400 Message-Id: <20230601212456.1533-4-demi@invisiblethingslab.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230601212456.1533-1-demi@invisiblethingslab.com> References: <20230601212456.1533-1-demi@invisiblethingslab.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767537733636712173?= X-GMAIL-MSGID: =?utf-8?q?1767537733636712173?= The NUL terminator for each target parameter string must precede the following 'struct dm_target_spec'. Otherwise, dm_split_args() might corrupt this struct. Furthermore, the first 'struct dm_target_spec' must come after the 'struct dm_ioctl', as if it overlaps too much dm_split_args() could corrupt the 'struct dm_ioctl'. Signed-off-by: Demi Marie Obenour Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org --- drivers/md/dm-ioctl.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 64e8f16d344c47057de5e2d29e3d63202197dca0..da6ca26b51d0953df380582bb3a51c2ec22c27cb 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1391,7 +1391,7 @@ static inline fmode_t get_mode(struct dm_ioctl *param) return mode; } -static int next_target(struct dm_target_spec *last, uint32_t next, void *end, +static int next_target(struct dm_target_spec *last, uint32_t next, const char *end, struct dm_target_spec **spec, char **target_params) { static_assert(_Alignof(struct dm_target_spec) <= 8, @@ -1404,7 +1404,7 @@ static int next_target(struct dm_target_spec *last, uint32_t next, void *end, * sizeof(struct dm_target_spec) or more, as otherwise *last was * out of bounds already. */ - size_t remaining = (char *)end - (char *)last; + size_t remaining = end - (char *)last; /* * There must be room for both the next target spec and the @@ -1423,10 +1423,7 @@ static int next_target(struct dm_target_spec *last, uint32_t next, void *end, *spec = (struct dm_target_spec *) ((unsigned char *) last + next); *target_params = (char *) (*spec + 1); - if (*spec < (last + 1)) - return -EINVAL; - - return invalid_str(*target_params, end); + return 0; } static int populate_table(struct dm_table *table, @@ -1436,8 +1433,9 @@ static int populate_table(struct dm_table *table, unsigned int i = 0; struct dm_target_spec *spec = (struct dm_target_spec *) param; uint32_t next = param->data_start; - void *end = (void *) param + param_size; + const char *const end = (const char *) param + param_size; char *target_params; + size_t min_size = sizeof(struct dm_ioctl); if (!param->target_count) { DMERR("%s: no targets specified", __func__); @@ -1445,6 +1443,13 @@ static int populate_table(struct dm_table *table, } for (i = 0; i < param->target_count; i++) { + const char *nul_terminator; + + if (next < min_size) { + DMERR("%s: next target spec (offset %u) overlaps %s", + __func__, next, i ? "previous target" : "'struct dm_ioctl'"); + return -EINVAL; + } r = next_target(spec, next, end, &spec, &target_params); if (r) { @@ -1452,6 +1457,15 @@ static int populate_table(struct dm_table *table, return r; } + nul_terminator = memchr(target_params, 0, (size_t)(end - target_params)); + if (nul_terminator == NULL) { + DMERR("%s: target parameters not NUL-terminated", __func__); + return -EINVAL; + } + + /* Add 1 for NUL terminator */ + min_size = (size_t)(nul_terminator - (const char *)spec) + 1; + r = dm_table_add_target(table, spec->target_type, (sector_t) spec->sector_start, (sector_t) spec->length, From patchwork Thu Jun 1 21:24:53 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Demi Marie Obenour X-Patchwork-Id: 102191 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp624665vqr; Thu, 1 Jun 2023 14:31:40 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4qLa3gPnztaccQhdl0R/gSQTGW2+CJhVO4q7kbOIoxz+ehNmPrMNZRBW86Cik4XfGATKyz X-Received: by 2002:a05:6358:8810:b0:123:230c:c3bd with SMTP id hv16-20020a056358881000b00123230cc3bdmr8807431rwb.11.1685655100368; Thu, 01 Jun 2023 14:31:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685655100; cv=none; d=google.com; s=arc-20160816; b=LrLRhmIX1OIBSIXWqyA9QP6JLLN14z/WiEjuHzvvhvJdtX2C1ejpCNCtvmDajX7CR9 wC4tr2T/eSm25F3g7NBqCxVQ/vYzbcpxybb+Dz9Muvn260lZyiX6TMjSpiwFFK8oYbCy 7jTZ+uK82YxwlzVq5jLE2troscvBrcKTcOJjwiX5pL1+0YbUIQpkXMVpfkM9xOlCpD6h Glre4FEQBUyU1ZE0hSHB18XOuy96suyhgPs+qhEuXr1YhBjfZzrTkC8OtITmdperxVvu rwL2sx1C9cURfJFc2QYWxQX6RAtFBUxf+ftqtmBeV3VT3PA8XjOkEV73Uj7qDb9nQ3AU 7+Rg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=vjypfpPRoU7xNHCTk2Gztx5IGWJumVDp62oiO1y8MH4=; b=vtQa8xNi70Nc+2bFxyrp8xuaHqYWDCfKXP52pEXN02unUgmXed5PF2dXlEvB8xOPnT OS/RVE8wtgWg3JBGKv4wYrh8LoObl62hJyX71heQV/9NcZLNwFaim5KX/Ix+iMLf7Mq/ 6r/Fk8Hj77LUHAZucoKdeXastAzs3AXig9V13KKGG5kpS80abwWTAHsTyM9I/pQXUl1L QwX/mkIMfdqPRHnbuD9mFtiGMO32FLEkl+tOVnivuOnvv9/VM6wzj+UhyFx0yeOTqBkS LOSw+uSf+RukhmpF8lLDTEsBwRby9mHrtfIUT+thtozTMt5QqV+ejbBZy9byuef0biyN eEeg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=QS6kbn1l; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=WTz8zIWL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id q127-20020a632a85000000b005428f25f67asi400722pgq.618.2023.06.01.14.31.23; Thu, 01 Jun 2023 14:31:40 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=QS6kbn1l; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=WTz8zIWL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231772AbjFAVZc (ORCPT + 99 others); Thu, 1 Jun 2023 17:25:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45688 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231555AbjFAVZV (ORCPT ); Thu, 1 Jun 2023 17:25:21 -0400 Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D7F85184; Thu, 1 Jun 2023 14:25:20 -0700 (PDT) Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 51B315C01D4; Thu, 1 Jun 2023 17:25:20 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Thu, 01 Jun 2023 17:25:20 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to; s=fm1; t=1685654720; x=1685741120; bh=vjypfpPRoU 7xNHCTk2Gztx5IGWJumVDp62oiO1y8MH4=; b=QS6kbn1lVsQPDjeMFPYE/Nfixp fCec3RGDWj6Zx5E0RTWRDq9aZpHhu181d4dpYWzyYWJkyS68BUpOBwWq9DhhATO8 +ZyBhwwLPCBa+DtOU5kHp2eKiyWC2Oecwar73chh2Mtx+xjBFcKIKA2khgz1rVeV dqolwNaATMsXQ1BpanFenABNHzXkYvKkVtEwHLQvT2qi7i/TzkBlH0Du9gu8Cb6q +xHgEyKWJM55WSAp9bmt3ilgAAwWbrBWRsCW+/NnfyBKVRpzG97LN/nVzPZ3VCBA RmlCK+QFDK/qWevsJMvnWVW5MPgUVXArM3gYHEelsbECGNCROp/bQaBKBN2A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t=1685654720; x= 1685741120; bh=vjypfpPRoU7xNHCTk2Gztx5IGWJumVDp62oiO1y8MH4=; b=W Tz8zIWLRlgVtvoDLu1mw4rwdnZkCAMXL782bpRiHn9mJ1e/HL6qrZ8PEDx9FODhn 6e3xsfUl+zdXAH57zyhQkqqlEDtqt81pCD/UmXnJ/BWgtQ5vvUn6Voicq3dVGEZG RYReNPna7FeinAC4Tblf1qkgk19vioYsk02MBisIZuqiiPCiTy+Bu6/tBnlnsNym gYgHTt6CYZgEAaSfaRovs3FKiAcrd/My1ThqoCXxRmVszwtuWWhn8Y5YjyoXOhiq OPt8Ix7lDNWHhNv1gwkal4GgI/FBiSG7IauAlSD09+ap6f/XohvCXb5+oHFmBkat zB53v6zhxe+Tb+GWDW7KQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrfeeluddgudeiudcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefhvfevufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffvghm ihcuofgrrhhivgcuqfgsvghnohhurhcuoeguvghmihesihhnvhhishhisghlvghthhhinh hgshhlrggsrdgtohhmqeenucggtffrrghtthgvrhhnpeejffejgffgueegudevvdejkefg hefghffhffejteekleeufeffteffhfdtudehteenucevlhhushhtvghrufhiiigvpedune curfgrrhgrmhepmhgrihhlfhhrohhmpeguvghmihesihhnvhhishhisghlvghthhhinhhg shhlrggsrdgtohhm X-ME-Proxy: Feedback-ID: iac594737:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 1 Jun 2023 17:25:19 -0400 (EDT) From: Demi Marie Obenour To: Alasdair Kergon , Mike Snitzer , dm-devel@redhat.com Cc: Demi Marie Obenour , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 4/6] device-mapper: Avoid double-fetch of version Date: Thu, 1 Jun 2023 17:24:53 -0400 Message-Id: <20230601212456.1533-5-demi@invisiblethingslab.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230601212456.1533-1-demi@invisiblethingslab.com> References: <20230601212456.1533-1-demi@invisiblethingslab.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767537482093037715?= X-GMAIL-MSGID: =?utf-8?q?1767537482093037715?= The version is fetched once in check_version(), which then does some validation and then overwrites the version in userspace with the API version supported by the kernel. copy_params() then fetches the version from userspace *again*, and this time no validation is done. The result is that the kernel's version number is completely controllable by userspace, provided that userspace can win a race condition. Fix this flaw by not copying the version back to the kernel the second time. This is not exploitable as the version is not further used in the kernel. However, it could become a problem if future patches start relying on the version field. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Demi Marie Obenour --- drivers/md/dm-ioctl.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index da6ca26b51d0953df380582bb3a51c2ec22c27cb..fd46b249f6f856c49752063fc49d720e95df0525 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1873,12 +1873,13 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) * As well as checking the version compatibility this always * copies the kernel interface version out. */ -static int check_version(unsigned int cmd, struct dm_ioctl __user *user) +static int check_version(unsigned int cmd, struct dm_ioctl __user *user, + struct dm_ioctl *kernel_params) { - uint32_t version[3]; int r = 0; + uint32_t *version = kernel_params->version; - if (copy_from_user(version, user->version, sizeof(version))) + if (copy_from_user(version, user->version, sizeof(user->version))) return -EFAULT; if ((version[0] != DM_VERSION_MAJOR) || @@ -1922,7 +1923,10 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern const size_t minimum_data_size = offsetof(struct dm_ioctl, data); unsigned int noio_flag; - if (copy_from_user(param_kernel, user, minimum_data_size)) + /* Version has been copied from userspace already, avoid TOCTOU */ + if (copy_from_user((char *)param_kernel + sizeof(param_kernel->version), + (char __user *)user + sizeof(param_kernel->version), + minimum_data_size - sizeof(param_kernel->version))) return -EFAULT; if (param_kernel->data_size < minimum_data_size) { @@ -2034,7 +2038,7 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us * Check the interface version passed in. This also * writes out the kernel's interface version. */ - r = check_version(cmd, user); + r = check_version(cmd, user, ¶m_kernel); if (r) return r; From patchwork Thu Jun 1 21:24:54 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Demi Marie Obenour X-Patchwork-Id: 102192 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp625155vqr; Thu, 1 Jun 2023 14:32:41 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6Gf5ZmPlqPvL9IAojRBAZpG1JBxyqMppktibpW9gi8gqWiYBq6q0iaA9OWT03DkFidFjk7 X-Received: by 2002:a05:6a00:1706:b0:63b:7a55:ae89 with SMTP id h6-20020a056a00170600b0063b7a55ae89mr9934864pfc.27.1685655160702; Thu, 01 Jun 2023 14:32:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685655160; cv=none; d=google.com; s=arc-20160816; b=oELtkaH3LEn4CgM/4wlG6f225nFgqkdD3dN5nOm04zN2rbtL4ZLhMH7w3cwUK04m3+ gMgOE/CMTSUz3nOfeak2YRjM4yENLJSkGkx+O2WceofZuw9Jv+4o8Ju3YAT7hfwQ9JS/ GmDI/jNPnEfi9g1XPDcqmE3jbVhL49R7Xo/trLOi9cVakQBlQ2pTwnnXMXhmtvS9x7nB JII+NGf1A1XZ6MIXivOyaERg1WovVxlTSbR0AVr8wh+Pc6YLan5fhBhzC/yoduWBZokk +RQ2aIjpaxUcKPi2PKP38t0ZK2mpbyHcNOvvItAD5tn721Nln9AjDuDdY6u9iYjv4ykf svNg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=ffgts7SPxxBHaUW6ToONfIVOqBLR5Qtq9BQQd24YCS0=; b=PIqlZsulu0ZJs6yAHyRE98KVnQNCfuwcHKxu+5lUDHgJG6PT7GaPZFQ6JxhdHZXawO asQWgAhQmt5hflEMZ1cZ3SFUaEFA0gtlatGpmTPSFDtoslgg3zDEPXmaIP2CRjoPgWFh 3nD237YRVkr9nX9lUGwCtCcIgz7keSaWFYS9uygUU3W13MpnRj6EkrebcVNLk7j5Zwl1 b9urFxzYhLTlKLetoVhwauWvBiqi1qmIUODiejHjwRM9rAYtaYYpnEPTYTik3//mo6lc 4cIHV3uOtzMO10YllRZSUQJZZBseGXQcNeagKMPRRbioD+1gQIEZgGnc2oVrnvi/FTOx KSTw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=mFKpWD+b; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=Dv1sD4ns; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 77-20020a630150000000b0052c688e6608si485474pgb.505.2023.06.01.14.32.25; Thu, 01 Jun 2023 14:32:40 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b=mFKpWD+b; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=Dv1sD4ns; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231941AbjFAVZf (ORCPT + 99 others); Thu, 1 Jun 2023 17:25:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45706 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231600AbjFAVZX (ORCPT ); Thu, 1 Jun 2023 17:25:23 -0400 Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6A4D5196 for ; Thu, 1 Jun 2023 14:25:22 -0700 (PDT) Received: from compute2.internal (compute2.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id B76685C01DE; Thu, 1 Jun 2023 17:25:21 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute2.internal (MEProxy); Thu, 01 Jun 2023 17:25:21 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to; s=fm1; t=1685654721; x=1685741121; bh=ffgts7SPxx BHaUW6ToONfIVOqBLR5Qtq9BQQd24YCS0=; b=mFKpWD+bo1BnXnUNmn90TseJTH zB9LGzQOGIh2TdQeK8B4IUEUfDF0SktjtFEtA5ePrda1NpjZR/OWEegZq46Lc2Tx w9risN2HGDpnmYc0FyA5eRbK90QtjwceqjOTzLOBmnS8FnF2zVFRK4DHXMd7ogmG UaDAPC9L6iE5jRk6jbJqkMdISXqJ3p1Z5xQ5QbHrhAfAqK1TKi4xtoNKbY6ZTP/X PlHWYTzzhJmHy30vAlPWfRKK0lR7bPzTNe0v0ySH0lp7LqikNZJjRoqwlICptW75 YuI858CCZgLiAOACOjRT3+WnM1DjUUxW24JwIrEKW4mmcAV+0jsjm3hOxc/Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t=1685654721; x= 1685741121; bh=ffgts7SPxxBHaUW6ToONfIVOqBLR5Qtq9BQQd24YCS0=; b=D v1sD4nspvJagskYKVDs0ENPh6b8ojw+Ac8rHiSgpnl84ZrmcOX0ABHdxZKeqipFd O3xTLaS0oR9pkOiX+6xywMA19bL4h84r+KiB3I5H/W8KCvoBVl8yKh2+PdtmGUm5 TV5GbSRMChEqlOfoxStcaimCgk0LNFqDezwsrLD+g1J51Si/RONSDMAlvQS/Hqcj XUpUH1EvfgMnjPfkdXU5IIlpfNCarZJyz8DdCK6QmZvnWPodu/KW6i3NWJRD7vlF RhWNHYgOwNDsKkrskbgwLo4+lLypJvSTm0JLYsVxdgQRaR9uJvi0pr+gv7gSurQ/ bDectfKORAJ6kZ+qVuoSw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrfeeluddgudeitdcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefhvfevufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffvghm ihcuofgrrhhivgcuqfgsvghnohhurhcuoeguvghmihesihhnvhhishhisghlvghthhhinh hgshhlrggsrdgtohhmqeenucggtffrrghtthgvrhhnpeejffejgffgueegudevvdejkefg hefghffhffejteekleeufeffteffhfdtudehteenucevlhhushhtvghrufhiiigvpedune curfgrrhgrmhepmhgrihhlfhhrohhmpeguvghmihesihhnvhhishhisghlvghthhhinhhg shhlrggsrdgtohhm X-ME-Proxy: Feedback-ID: iac594737:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 1 Jun 2023 17:25:21 -0400 (EDT) From: Demi Marie Obenour To: Alasdair Kergon , Mike Snitzer , dm-devel@redhat.com Cc: Demi Marie Obenour , linux-kernel@vger.kernel.org Subject: [PATCH 5/6] device-mapper: Refuse to create device named "control" Date: Thu, 1 Jun 2023 17:24:54 -0400 Message-Id: <20230601212456.1533-6-demi@invisiblethingslab.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230601212456.1533-1-demi@invisiblethingslab.com> References: <20230601212456.1533-1-demi@invisiblethingslab.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767537545562559086?= X-GMAIL-MSGID: =?utf-8?q?1767537545562559086?= Typical userspace setups create a symlink under /dev/mapper with the name of the device, but /dev/mapper/control is reserved for the control device. Therefore, trying to create such a device is almost certain to be a userspace bug. Signed-off-by: Demi Marie Obenour --- drivers/md/dm-ioctl.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index fd46b249f6f856c49752063fc49d720e95df0525..b12592bcb4b2b8513f5da6208fb545203534d7ff 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -767,7 +767,12 @@ static int get_target_version(struct file *filp, struct dm_ioctl *param, size_t static int check_name(const char *name) { if (strchr(name, '/')) { - DMERR("invalid device name"); + DMERR("device name cannot contain '/'"); + return -EINVAL; + } + + if (strcmp(name, DM_CONTROL_NODE) == 0) { + DMERR("device name cannot be \"%s\"", DM_CONTROL_NODE); return -EINVAL; } From patchwork Thu Jun 1 21:24:55 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Demi Marie Obenour X-Patchwork-Id: 102193 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp626163vqr; Thu, 1 Jun 2023 14:34:49 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ69rv89TzjEhspLszq62BOfA5Jv/hXjNFVWcKOmKt9DZI0I+M2e08NgDyG76mNnq8xjKY1t X-Received: by 2002:a05:6a20:e19b:b0:ff:ed6b:4c9e with SMTP id ks27-20020a056a20e19b00b000ffed6b4c9emr10643146pzb.36.1685655289657; Thu, 01 Jun 2023 14:34:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685655289; cv=none; d=google.com; s=arc-20160816; b=TEnS9/13mbHE3gFnRm6MnN86UxbrpkvjqPWUoWEUqNQikP81JUyZRRGL5WUIoJPTFm ttU1c5tIzCkLOrD8r74EpuQDX7zBq+jNKUCQMhE/7QfHpokwmRWmaDK1+S13eCOZS2MS 39acfNp+UVrkhGB0SrXqz3twpxeAae99Gno0RqQ+V6WK9dt5cTFBE7wHDB1cxsl0DsUe JS2pSVuKL4rjZpLrMRvNcRxsRkwALwnEp8j4/M6nw2ekkBKCGc228+lGXuRPpWIElovg DXIJ43GqiYIAUG7u3fbEPbB6zLKZ5Q/02TfiAw/ymt7DCDOzIqgc0TghuFRu4NS2Dljb A9cw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=h/1KwQmVaBXUd1H3OHkX9KZBr+WvyoaYktC9lrYuvik=; b=Br08o0hW9cLHrKDH71Q5xXA5dwQTmwtygeEVxbTtFJnkuE9jPmmArM+xzQVEL1Oe13 0ynZDcykRlrHfNoO9eR+qspT2DSp7KH2ES340mE/ge20Ora9NgX2LSbE+FFZqrOGfEaC OFZEvNKARkRssBrPTklaiuXDhvLaQt+BXyK9w/iiNl6fFkbR7Na/R1SiPA7hIoq2Xtak Rgj7ILVx6HbMoqE9DBv51At9wVrFGkpPOO2xb7dTTlXdmx8uF0fN2bywr6lVqIb+SHx2 dqGpQRW1hsDhnt47Aye3fGiUdrNVSh4nBi8zf9gYLzQClxoDosJ+dQaxtZ4ecEXQBslr 9svQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b="kMK42/eP"; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=aTkAGIVw; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id l7-20020a63be07000000b0052866b25be5si3303326pgf.746.2023.06.01.14.34.34; Thu, 01 Jun 2023 14:34:49 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@invisiblethingslab.com header.s=fm1 header.b="kMK42/eP"; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=aTkAGIVw; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232160AbjFAVZl (ORCPT + 99 others); Thu, 1 Jun 2023 17:25:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45720 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231700AbjFAVZZ (ORCPT ); Thu, 1 Jun 2023 17:25:25 -0400 Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A08CB195 for ; Thu, 1 Jun 2023 14:25:24 -0700 (PDT) Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id 1827B5C01D9; Thu, 1 Jun 2023 17:25:24 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute5.internal (MEProxy); Thu, 01 Jun 2023 17:25:24 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to; s=fm1; t=1685654724; x=1685741124; bh=h/1KwQmVaB XUd1H3OHkX9KZBr+WvyoaYktC9lrYuvik=; b=kMK42/eP2QQw4iUjZwnuhTf7+N I8hnwQvpNyGrcpi701r+NYHbQNUNNtEkwodP+KKRX25LcWStIj6vg866vTVQ6t3c bldGK7ptPX1Gw6AspQW46YYt36yXWssA/PptTC7RvTMO784ZrR+uyt+kdQoXNxsM nDBewdaCVISlh5JZ19A4bDdvWKN6/L+L8QT8Q98+tgiKO79IwN6gJfzHNCiCx2cH I5expoAb73sL4DRIUBcdrcF8f0Ha7O7XlAuFfLn3yw2bbGqibn4yTc5gloWJKe7O ajCG3rM4H2NA+xa751J0cyC98iNe9YXFT6yluN7w2Kb8eyM6fdjL3QD7c+fQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t=1685654724; x= 1685741124; bh=h/1KwQmVaBXUd1H3OHkX9KZBr+WvyoaYktC9lrYuvik=; b=a TkAGIVwq2iFivqFUKv2DA1VXOJJnOlnFEzrgATMUTlhvLHCgMW/qBYE6xJHH68Rc 59UUXKm7wT4hq98cjMhkY+KnWJLS8nH0Sym3gB82X2HAydwujG/4Uz67emSIKOPc dOofJ08BkOCrCY2L0FPK0B9Hi9FE+vNkkyTyGEHJ2cMdtMminLMqWqFVE2zXnChz Fk6WhTpiRuMyhjnDzLtsWQ1y5hgOdhpN+UBzMVauvtZ1jjGKLly1L9fMgzxt32tX mjD9kfCAacfZh4MBl3d8yaJtA5vPfScToCaSNEYieLfPPbbdHQqCBjYzZC3Fp9yw Pwfor2M+KQyJooGa4MvCA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrfeeluddgudeiudcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefhvfevufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffvghm ihcuofgrrhhivgcuqfgsvghnohhurhcuoeguvghmihesihhnvhhishhisghlvghthhhinh hgshhlrggsrdgtohhmqeenucggtffrrghtthgvrhhnpeejffejgffgueegudevvdejkefg hefghffhffejteekleeufeffteffhfdtudehteenucevlhhushhtvghrufhiiigvpedune curfgrrhgrmhepmhgrihhlfhhrohhmpeguvghmihesihhnvhhishhisghlvghthhhinhhg shhlrggsrdgtohhm X-ME-Proxy: Feedback-ID: iac594737:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 1 Jun 2023 17:25:23 -0400 (EDT) From: Demi Marie Obenour To: Alasdair Kergon , Mike Snitzer , dm-devel@redhat.com Cc: Demi Marie Obenour , linux-kernel@vger.kernel.org Subject: [PATCH 6/6] device-mapper: "." and ".." are not valid symlink names Date: Thu, 1 Jun 2023 17:24:55 -0400 Message-Id: <20230601212456.1533-7-demi@invisiblethingslab.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230601212456.1533-1-demi@invisiblethingslab.com> References: <20230601212456.1533-1-demi@invisiblethingslab.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767537680827275472?= X-GMAIL-MSGID: =?utf-8?q?1767537680827275472?= Using either of these is going to greatly confuse userspace, as they are not valid symlink names and so creating the usual /dev/mapper/NAME symlink will not be possible. As creating a device with either of these names is almost certainly a userspace bug, just error out. Signed-off-by: Demi Marie Obenour --- drivers/md/dm-ioctl.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index b12592bcb4b2b8513f5da6208fb545203534d7ff..adf0c4becc743e4ad59e1d6b0ef108ddd56f207d 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -771,8 +771,10 @@ static int check_name(const char *name) return -EINVAL; } - if (strcmp(name, DM_CONTROL_NODE) == 0) { - DMERR("device name cannot be \"%s\"", DM_CONTROL_NODE); + if (strcmp(name, DM_CONTROL_NODE) == 0 || + strcmp(name, ".") == 0 || + strcmp(name, "..") == 0) { + DMERR("device name cannot be \"%s\", \".\", or \"..\"", DM_CONTROL_NODE); return -EINVAL; }