diff options
| author | Mikulas Patocka <mpatocka@redhat.com> | 2020-03-22 20:42:21 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-04-17 10:50:17 +0200 |
| commit | 833309f3fb511b4e4873a0a39b8be7ac747d6d3d (patch) | |
| tree | 6c40b0ac944e9c532907f157dc4c5ec40fbd6414 /drivers/md/dm-integrity.c | |
| parent | bef0d2f5fdcbc39f2c5b321d35d2c8b2f1e99612 (diff) | |
| download | linux-stable-833309f3fb511b4e4873a0a39b8be7ac747d6d3d.tar.gz linux-stable-833309f3fb511b4e4873a0a39b8be7ac747d6d3d.tar.bz2 linux-stable-833309f3fb511b4e4873a0a39b8be7ac747d6d3d.zip | |
dm integrity: fix a crash with unusually large tag size
commit b93b6643e9b5a7f260b931e97f56ffa3fa65e26d upstream.
If the user specifies tag size larger than HASH_MAX_DIGESTSIZE,
there's a crash in integrity_metadata().
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/md/dm-integrity.c')
| -rw-r--r-- | drivers/md/dm-integrity.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c index 145bc2e7eaf0..56248773a9e0 100644 --- a/drivers/md/dm-integrity.c +++ b/drivers/md/dm-integrity.c @@ -1514,7 +1514,7 @@ static void integrity_metadata(struct work_struct *w) struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io)); char *checksums; unsigned extra_space = unlikely(digest_size > ic->tag_size) ? digest_size - ic->tag_size : 0; - char checksums_onstack[HASH_MAX_DIGESTSIZE]; + char checksums_onstack[max((size_t)HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; unsigned sectors_to_process = dio->range.n_sectors; sector_t sector = dio->range.logical_sector; @@ -1743,7 +1743,7 @@ retry_kmap: } while (++s < ic->sectors_per_block); #ifdef INTERNAL_VERIFY if (ic->internal_hash) { - char checksums_onstack[max(HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; + char checksums_onstack[max((size_t)HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; integrity_sector_checksum(ic, logical_sector, mem + bv.bv_offset, checksums_onstack); if (unlikely(memcmp(checksums_onstack, journal_entry_tag(ic, je), ic->tag_size))) { |