From patchwork Wed Nov 7 21:24:55 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Milan Broz X-Patchwork-Id: 10673109 X-Patchwork-Delegate: snitzer@redhat.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2EE6813A4 for ; Wed, 7 Nov 2018 21:42:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1CD242D011 for ; Wed, 7 Nov 2018 21:42:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1045E2D01C; Wed, 7 Nov 2018 21:42:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.7 required=2.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 914552D011 for ; Wed, 7 Nov 2018 21:42:10 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 692DC80F9C; Wed, 7 Nov 2018 21:42:08 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 6B5A65C88D; Wed, 7 Nov 2018 21:42:06 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 2DB8E4CA95; Wed, 7 Nov 2018 21:42:03 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id wA7LPLdf022417 for ; Wed, 7 Nov 2018 16:25:21 -0500 Received: by smtp.corp.redhat.com (Postfix) id 41E65601A2; Wed, 7 Nov 2018 21:25:21 +0000 (UTC) Delivered-To: dm-devel@redhat.com Received: from mx1.redhat.com (ext-mx14.extmail.prod.ext.phx2.redhat.com [10.5.110.43]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 47CFE6015E; Wed, 7 Nov 2018 21:25:15 +0000 (UTC) Received: from mail-wr1-f68.google.com (mail-wr1-f68.google.com [209.85.221.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id E1B5C3002C85; Wed, 7 Nov 2018 21:25:13 +0000 (UTC) Received: by mail-wr1-f68.google.com with SMTP id u9-v6so8627517wrr.0; Wed, 07 Nov 2018 13:25:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=oi5LSRF4qWEuqFLppVWdo/FfHh3CsNUu8bfRZcY1V2U=; b=RzMnyFw+VO2KUfurhDGLczsFjQkpHgTBxwT31xmaXTi5YZltZ08RWIU2XbERY9ORWG iv+osVHNHjUNkQMp08mK094LJXCFW9ECFVFD8koZg5QCGeMIEom4RDjCrBDhlgPqrUSD oyd4lqRfHRrqwDD4I4XlwT79OUNNOZb8r+nysJr03HznBv0Gtpasrv3CqYb7IijQA6QS WnRs+1tpjvRDYxDlfeh11/k2myZvbq6kSKHe4oMSrd99SA4hy1HzgTaxJ253CLDZM5UX UFZYqtxQvxA904/aqwTP0UpQ3Jptz3kxsCaUsQnaUpFajJgmD2nhvrX6Qp9BSCeymcIj uigQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=oi5LSRF4qWEuqFLppVWdo/FfHh3CsNUu8bfRZcY1V2U=; b=EuDQGr1/H9dhTIriHzuYU8P3VpUOw16PyXRO99+Zn79cVM4DNhlt5UxtUlET6WoguH r7NwijnXqLeGvI985CMNsm9ZQ4u6ztCrSWRMf222dxcsDa6AT96tP/ZJU6UvpZmwYtMG JXXRcsbWElY+k0Ff/ZHRRizyyOJ5SmwQFZAmcCjXVdadD6NEY8PGZpW5uTLDIqgEhGc7 1cBWnLVxGk+FuEQIq0WQD8mD9CUZjgxvKD871pDSH9ETSGyYZLaB1pltXD5zRdSjyov2 gF3Q9F8SL3ICE9o3gAyZcU/D1+KCFokyy6TroOV7TTk/5z428vpWvmeIPr2ZErd8CSCG psWg== X-Gm-Message-State: AGRZ1gI1PqMjYdUhRToeZKBBa9lAEhewKJgQccw16B/ivJ4chO+5Z5rE CHRPBlnfXWfIqjmKfO6dLWAl5Q8a X-Google-Smtp-Source: AJdET5cn33kpEUlQzot61QeypzT3tDZYwhjSYTRhqheiLtn8HvUImk57KmjVntTc33kQY8I9ODkcJg== X-Received: by 2002:adf:f501:: with SMTP id q1-v6mr1713308wro.63.1541625912045; Wed, 07 Nov 2018 13:25:12 -0800 (PST) Received: from merlot.mazyland.net (dynamic-2a00-1028-96c1-4f6a-1324-e14e-ce43-0b02.ipv6.broadband.iol.cz. [2a00:1028:96c1:4f6a:1324:e14e:ce43:b02]) by smtp.googlemail.com with ESMTPSA id y16-v6sm2426579wrn.18.2018.11.07.13.25.11 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Nov 2018 13:25:11 -0800 (PST) From: Milan Broz To: dm-devel@redhat.com Date: Wed, 7 Nov 2018 22:24:55 +0100 Message-Id: <20181107212455.7332-1-gmazyland@gmail.com> In-Reply-To: References: MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.43]); Wed, 07 Nov 2018 21:25:14 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.43]); Wed, 07 Nov 2018 21:25:14 +0000 (UTC) for IP:'209.85.221.68' DOMAIN:'mail-wr1-f68.google.com' HELO:'mail-wr1-f68.google.com' FROM:'gmazyland@gmail.com' RCPT:'' X-RedHat-Spam-Score: -0.111 (DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_PASS) 209.85.221.68 mail-wr1-f68.google.com 209.85.221.68 mail-wr1-f68.google.com X-Scanned-By: MIMEDefang 2.84 on 10.5.110.43 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-loop: dm-devel@redhat.com Cc: mpatocka@redhat.com, Milan Broz , snitzer@redhat.com Subject: [dm-devel] [PATCH v2] dm: Check for device sector overflow if CONFIG_LBDAF is not set X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dm-devel-bounces@redhat.com Errors-To: dm-devel-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Wed, 07 Nov 2018 21:42:09 +0000 (UTC) X-Virus-Scanned: ClamAV using ClamSMTP Reference to a device in device-mapper table contains offset in sectors. If the sector_t is 32bit integer (CONFIG_LBDAF is not set), then several device-mapper targets can overflow this offset and validity check is then performed on a wrong offset and a wrong table is activated. See for example (on 32bit without CONFIG_LBDAF) this overflow: # dmsetup create test --table "0 2048 linear /dev/sdg 4294967297" # dmsetup table test 0 2048 linear 8:96 1 This patch adds explicit check for overflow if the offset is sector_t type. Signed-off-by: Milan Broz Reviewed-by: Mikulas Patocka --- drivers/md/dm-crypt.c | 2 +- drivers/md/dm-delay.c | 2 +- drivers/md/dm-flakey.c | 2 +- drivers/md/dm-linear.c | 2 +- drivers/md/dm-raid1.c | 3 ++- drivers/md/dm-unstripe.c | 2 +- 6 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 49be7a6a2e81..a41fe7975dc6 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -2781,7 +2781,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) } ret = -EINVAL; - if (sscanf(argv[4], "%llu%c", &tmpll, &dummy) != 1) { + if (sscanf(argv[4], "%llu%c", &tmpll, &dummy) != 1 || tmpll != (sector_t)tmpll) { ti->error = "Invalid device sector"; goto bad; } diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c index 2fb7bb4304ad..fddffe251bf6 100644 --- a/drivers/md/dm-delay.c +++ b/drivers/md/dm-delay.c @@ -141,7 +141,7 @@ static int delay_class_ctr(struct dm_target *ti, struct delay_class *c, char **a unsigned long long tmpll; char dummy; - if (sscanf(argv[1], "%llu%c", &tmpll, &dummy) != 1) { + if (sscanf(argv[1], "%llu%c", &tmpll, &dummy) != 1 || tmpll != (sector_t)tmpll) { ti->error = "Invalid device sector"; return -EINVAL; } diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c index 3cb97fa4c11d..8261aa8c7fe1 100644 --- a/drivers/md/dm-flakey.c +++ b/drivers/md/dm-flakey.c @@ -213,7 +213,7 @@ static int flakey_ctr(struct dm_target *ti, unsigned int argc, char **argv) devname = dm_shift_arg(&as); r = -EINVAL; - if (sscanf(dm_shift_arg(&as), "%llu%c", &tmpll, &dummy) != 1) { + if (sscanf(dm_shift_arg(&as), "%llu%c", &tmpll, &dummy) != 1 || tmpll != (sector_t)tmpll) { ti->error = "Invalid device sector"; goto bad; } diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c index 8d7ddee6ac4d..ad980a38fb1e 100644 --- a/drivers/md/dm-linear.c +++ b/drivers/md/dm-linear.c @@ -45,7 +45,7 @@ static int linear_ctr(struct dm_target *ti, unsigned int argc, char **argv) } ret = -EINVAL; - if (sscanf(argv[1], "%llu%c", &tmp, &dummy) != 1) { + if (sscanf(argv[1], "%llu%c", &tmp, &dummy) != 1 || tmp != (sector_t)tmp) { ti->error = "Invalid device sector"; goto bad; } diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c index 79eab1071ec2..5a51151f680d 100644 --- a/drivers/md/dm-raid1.c +++ b/drivers/md/dm-raid1.c @@ -943,7 +943,8 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti, char dummy; int ret; - if (sscanf(argv[1], "%llu%c", &offset, &dummy) != 1) { + if (sscanf(argv[1], "%llu%c", &offset, &dummy) != 1 || + offset != (sector_t)offset) { ti->error = "Invalid offset"; return -EINVAL; } diff --git a/drivers/md/dm-unstripe.c b/drivers/md/dm-unstripe.c index 954b7ab4e684..e673dacf6418 100644 --- a/drivers/md/dm-unstripe.c +++ b/drivers/md/dm-unstripe.c @@ -78,7 +78,7 @@ static int unstripe_ctr(struct dm_target *ti, unsigned int argc, char **argv) goto err; } - if (sscanf(argv[4], "%llu%c", &start, &dummy) != 1) { + if (sscanf(argv[4], "%llu%c", &start, &dummy) != 1 || start != (sector_t)start) { ti->error = "Invalid striped device offset"; goto err; }