| Message ID | 20200804092501.7938-1-johannes.thumshirn@wdc.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | dm: don't call report zones for more than the user requested | expand |
On 2020/08/04 18:25, Johannes Thumshirn wrote: > Don't call report zones for more zones than the user actually requested, > otherwise this can lead to out-of-bounds accesses in the callback > functions. > > Such a situation can happen if the target's ->report_zones() callback > function returns 0 because we've reached the end of the target and then > restart the report zones on the second target. > > We're again calling into ->report_zones() and ultimately into the user > supplied callback function but when we're not subtracting the number of > zones already processed this may lead to out-of-bounds accesses in the > user callbacks. > > Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> > --- > drivers/md/dm.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/md/dm.c b/drivers/md/dm.c > index 5b9de2f71bb0..88b391ff9bea 100644 > --- a/drivers/md/dm.c > +++ b/drivers/md/dm.c > @@ -504,7 +504,8 @@ static int dm_blk_report_zones(struct gendisk *disk, sector_t sector, > } > > args.tgt = tgt; > - ret = tgt->type->report_zones(tgt, &args, nr_zones); > + ret = tgt->type->report_zones(tgt, &args, > + nr_zones - args.zone_idx); > if (ret < 0) > goto out; > } while (args.zone_idx < nr_zones && > Looks good. I think this needs a Cc: stable. Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
On 04/08/2020 12:17, Damien Le Moal wrote: > > Looks good. I think this needs a Cc: stable. Indeed, Mike can you add these two when applying or do you want me to resend? Fixes: d41003513e61 ("block: rework zone reporting") Cc: stable@vger.kernel.org # v5.5+
On Tue, Aug 04 2020 at 7:26am -0400, Johannes Thumshirn <Johannes.Thumshirn@wdc.com> wrote: > On 04/08/2020 12:17, Damien Le Moal wrote: > > > > Looks good. I think this needs a Cc: stable. > > Indeed, Mike can you add these two when applying or do you want me to resend? > > Fixes: d41003513e61 ("block: rework zone reporting") > Cc: stable@vger.kernel.org # v5.5+ I can apply those tags, thanks.
diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 5b9de2f71bb0..88b391ff9bea 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -504,7 +504,8 @@ static int dm_blk_report_zones(struct gendisk *disk, sector_t sector, } args.tgt = tgt; - ret = tgt->type->report_zones(tgt, &args, nr_zones); + ret = tgt->type->report_zones(tgt, &args, + nr_zones - args.zone_idx); if (ret < 0) goto out; } while (args.zone_idx < nr_zones &&
Don't call report zones for more zones than the user actually requested, otherwise this can lead to out-of-bounds accesses in the callback functions. Such a situation can happen if the target's ->report_zones() callback function returns 0 because we've reached the end of the target and then restart the report zones on the second target. We're again calling into ->report_zones() and ultimately into the user supplied callback function but when we're not subtracting the number of zones already processed this may lead to out-of-bounds accesses in the user callbacks. Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> --- drivers/md/dm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)