On Wed, 19 May 2021 at 16:56, Sasha Levin sashal@kernel.org wrote:
On Wed, May 19, 2021 at 09:41:24AM +0200, Ard Biesheuvel wrote:
From: Mikulas Patocka mpatocka@redhat.com
commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
If there are not any dm devices, we need to zero the "dev" argument in the first structure dm_name_list. However, this can cause out of bounds write, because the "needed" variable is zero and len may be less than eight.
Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is too small to hold the "nl->dev" value.
Signed-off-by: Mikulas Patocka mpatocka@redhat.com Reported-by: Dan Carpenter dan.carpenter@oracle.com Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer snitzer@redhat.com Signed-off-by: Ard Biesheuvel ardb@kernel.org
Please apply to 4.4.y and 4.9.y
We already carry this patch via the backport provided in https://lore.kernel.org/stable/20210513094552.266451-1-nobuhiro1.iwamatsu@to...
Excellent, thanks.