Skip to content

K
Kernel

openeuler / Kernel
1 年多 前同步成功

通知 8
Star 0
Fork 0
K
Kernel
切换分支/标签
  1. 19 10月, 2018 3 次提交
  3. 18 10月, 2018 1 次提交
    • W
      dm ioctl: harden copy_params()'s copy_from_user() from malicious users · 800a7340
      由 Wenwen Wang 提交于 
      In copy_params(), the struct 'dm_ioctl' is first copied from the user
space buffer 'user' to 'param_kernel' and the field 'data_size' is
checked against 'minimum_data_size' (size of 'struct dm_ioctl' payload
up to its 'data' member).  If the check fails, an error code EINVAL will be
returned.  Otherwise, param_kernel->data_size is used to do a second copy,
which copies from the same user-space buffer to 'dmi'.  After the second
copy, only 'dmi->data_size' is checked against 'param_kernel->data_size'.
Given that the buffer 'user' resides in the user space, a malicious
user-space process can race to change the content in the buffer between
the two copies.  This way, the attacker can inject inconsistent data
into 'dmi' (versus previously validated 'param_kernel').

Fix redundant copying of 'minimum_data_size' from user-space buffer by
using the first copy stored in 'param_kernel'.  Also remove the
'data_size' check after the second copy because it is now unnecessary.

Cc: stable@vger.kernel.org
Signed-off-by: NWenwen Wang <wang6495@umn.edu>
Signed-off-by: NMike Snitzer <snitzer@redhat.com>
      800a7340
  5. 17 10月, 2018 3 次提交
  7. 12 10月, 2018 1 次提交
  9. 11 10月, 2018 4 次提交
  11. 10 10月, 2018 2 次提交
    • D
      dm: fix report zone remapping to account for partition offset · 9864cd5d
      由 Damien Le Moal 提交于 
      If dm-linear or dm-flakey are layered on top of a partition of a zoned
block device, remapping of the start sector and write pointer position
of the zones reported by a report zones BIO must be modified to account
for the target table entry mapping (start offset within the device and
entry mapping with the dm device).  If the target's backing device is a
partition of a whole disk, the start sector on the physical device of
the partition must also be accounted for when modifying the zone
information.  However, dm_remap_zone_report() was not considering this
last case, resulting in incorrect zone information remapping with
targets using disk partitions.

Fix this by calculating the target backing device start sector using
the position of the completed report zones BIO and the unchanged
position and size of the original report zone BIO. With this value
calculated, the start sector and write pointer position of the target
zones can be correctly remapped.

Fixes: 10999307 ("dm: introduce dm_remap_zone_report()")
Cc: stable@vger.kernel.org
Signed-off-by: NDamien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: NMike Snitzer <snitzer@redhat.com>
      9864cd5d
    • S
      dm cache: destroy migration_cache if cache target registration failed · c7cd5550
      由 Shenghui Wang 提交于 
      Commit 7e6358d2 ("dm: fix various targets to dm_register_target
after module __init resources created") inadvertently introduced this
bug when it moved dm_register_target() after the call to KMEM_CACHE().

Fixes: 7e6358d2 ("dm: fix various targets to dm_register_target after module __init resources created")
Cc: stable@vger.kernel.org
Signed-off-by: NShenghui Wang <shhuiw@foxmail.com>
Signed-off-by: NMike Snitzer <snitzer@redhat.com>
      c7cd5550
  13. 07 10月, 2018 7 次提交
  15. 06 10月, 2018 19 次提交