dm ioctl: fix out of bounds array access when no devices
stable inclusion from stable-5.10.27 commit 921aae17bb0f02181fa05cf5580ebc855fdbd74d bugzilla: 51493 -------------------------------- commit 4edbe1d7 upstream. If there are not any dm devices, we need to zero the "dev" argument in the first structure dm_name_list. However, this can cause out of bounds write, because the "needed" variable is zero and len may be less than eight. Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is too small to hold the "nl->dev" value. Signed-off-by:Mikulas Patocka <mpatocka@redhat.com> Reported-by:
Dan Carpenter <dan.carpenter@oracle.com> Cc: stable@vger.kernel.org Signed-off-by:
Mike Snitzer <snitzer@redhat.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
Chen Jun <chenjun102@huawei.com> Acked-by:
Weilong Chen <chenweilong@huawei.com> Signed-off-by:
Zheng Zengkai <zhengzengkai@huawei.com>
Loading
Please sign in to comment