kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/md
History
Benjamin Randazzo e46e18eb38 md: use kzalloc() when bitmap is disabled 
[ Upstream commit 33afeac21b ]

commit b6878d9e03 upstream.

In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a
mdu_bitmap_file_t called "file".

5769         file = kmalloc(sizeof(*file), GFP_NOIO);
5770         if (!file)
5771                 return -ENOMEM;

This structure is copied to user space at the end of the function.

5786         if (err == 0 &&
5787             copy_to_user(arg, file, sizeof(*file)))
5788                 err = -EFAULT

But if bitmap is disabled only the first byte of "file" is initialized
with zero, so it's possible to read some bytes (up to 4095) of kernel
space memory from user space. This is an information leak.

5775         /* bitmap disabled, zero the first byte and copy out */
5776         if (!mddev->bitmap_info.file)
5777                 file->pathname[0] = '\0';

Signed-off-by: Benjamin Randazzo <benjamin@randazzo.fr>
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2015-08-20 17:33:11 -04:00
..
bcache block: disable entropy contributions for nonrot devices 2014-10-04 10:55:32 -06:00
persistent-data dm btree: silence lockdep lock inversion in dm_btree_del() 2015-08-04 14:24:53 -04:00
bitmap.c md/bitmap: always wait for writes on unplug. 2014-10-09 10:07:04 +11:00
bitmap.h kernfs: s/sysfs_dirent/kernfs_node/ and rename its friends accordingly 2013-12-11 15:28:36 -08:00
dm-bio-prison.c dm bio prison: implement per bucket locking in the dm_bio_prison hash table 2014-06-11 16:48:54 -04:00
dm-bio-prison.h dm thin: return ENOSPC instead of EIO when error_if_no_space enabled 2014-06-03 13:44:08 -04:00
dm-bio-record.h dm: Refactor for new bio cloning/splitting 2013-11-23 22:33:55 -08:00
dm-bufio.c dm bufio: fix memleak when using a dm_buffer's inline bio 2015-01-08 10:30:18 -08:00
dm-bufio.h dm snapshot: use dm-bufio prefetch 2014-01-14 23:23:03 -05:00
dm-builtin.c dm sysfs: fix a module unload race 2014-01-14 23:23:04 -05:00
dm-cache-block-types.h dm cache: remove remainder of distinct discard block size 2014-03-27 16:56:23 -04:00
dm-cache-metadata.c dm cache: fix missing ERR_PTR returns and handling 2015-02-05 22:36:06 -08:00
dm-cache-metadata.h dm cache metadata: use dm-space-map-metadata.h defined size limits 2014-08-01 12:30:33 -04:00
dm-cache-policy-cleaner.c dm cache: policy change version from string to integer set 2013-03-20 17:21:27 +00:00
dm-cache-policy-internal.h dm cache: add remove_cblock method to policy interface 2013-11-11 11:37:50 -05:00
dm-cache-policy-mq.c dm cache mq: fix memory allocation failure for large cache devices 2014-02-28 12:18:29 -05:00
dm-cache-policy.c dm cache: add policy name to status output 2014-01-16 13:44:11 -05:00
dm-cache-policy.h dm cache: add policy name to status output 2014-01-16 13:44:11 -05:00
dm-cache-target.c dm cache: fix problematic dual use of a single migration count variable 2015-01-29 17:40:44 -08:00
dm-crypt.c Revert "dm crypt: fix deadlock when async crypto algorithm returns -EBUSY" 2015-05-23 15:53:28 -04:00
dm-delay.c Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block 2014-01-30 11:19:05 -08:00
dm-era-target.c dm era: check for a non-NULL metadata object before closing it 2014-06-03 13:44:08 -04:00
dm-exception-store.c dm: replace simple_strtoul 2012-07-27 15:07:59 +01:00
dm-exception-store.h dm snapshot: test chunk size against both origin and snapshot 2010-08-12 04:13:51 +01:00
dm-flakey.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-io.c dm io: deal with wandering queue limits when handling REQ_DISCARD and REQ_WRITE_SAME 2015-04-16 20:11:46 -04:00
dm-ioctl.c dm: allow active and inactive tables to share dm_devs 2014-10-05 20:03:35 -04:00
dm-kcopyd.c dm: stop using WQ_NON_REENTRANT 2013-08-23 09:02:13 -04:00
dm-linear.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-log-userspace-base.c dm log userspace: allow mark requests to piggyback on flush requests 2014-01-21 23:46:27 -05:00
dm-log-userspace-transfer.c dm log userspace: fix memory leak in dm_ulog_tfr_init failure path 2014-10-05 20:03:38 -04:00
dm-log-userspace-transfer.h dm log: userspace add luid to distinguish between concurrent log instances 2009-09-04 20:40:34 +01:00
dm-log.c dm: use memweight() 2012-07-30 17:25:16 -07:00
dm-mpath.c dm mpath: stop queueing IO when no valid paths exist 2014-10-05 20:03:35 -04:00
dm-mpath.h dm mpath: remove is_active from struct dm_path 2008-10-10 13:36:58 +01:00
dm-path-selector.c md: Add module.h to all files using it implicitly 2011-10-31 19:31:18 -04:00
dm-path-selector.h dm mpath: add start_io and nr_bytes to path selectors 2009-06-22 10:12:27 +01:00
dm-queue-length.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-raid.c dm raid: fix inaccessible superblocks causing oops in configure_discard_support 2014-10-29 14:53:27 -04:00
dm-raid1.c dm mirror: do not degrade the mirror on discard error 2015-03-23 21:02:47 -04:00
dm-region-hash.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-round-robin.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-service-time.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-snap-persistent.c dm snapshot: fix metadata corruption 2014-03-03 17:58:13 -05:00
dm-snap-transient.c md: Add in export.h for files using EXPORT_SYMBOL 2011-10-31 19:31:19 -04:00
dm-snap.c dm snapshot: suspend merging snapshot when doing exception handover 2015-04-16 20:13:10 -04:00
dm-stats.c dm stats: fix divide by zero if 'number_of_areas' arg is zero 2015-07-03 23:02:33 -04:00
dm-stats.h dm: add statistics support 2013-09-05 20:46:06 -04:00
dm-stripe.c dm stripe: fix potential for leak in stripe_ctr error path 2014-10-10 22:05:18 -04:00
dm-switch.c dm switch: efficiently support repetitive patterns 2014-08-01 12:30:37 -04:00
dm-sysfs.c dm sysfs: fix a module unload race 2014-01-14 23:23:04 -05:00
dm-table.c dm: allow active and inactive tables to share dm_devs 2014-10-05 20:03:35 -04:00
dm-target.c dm: allow error target to replace bio-based and request-based targets 2013-09-05 20:46:05 -04:00
dm-thin-metadata.c dm thin metadata: do not allow the data block size to change 2014-07-15 14:05:26 -04:00
dm-thin-metadata.h dm thin: ensure user takes action to validate data and metadata consistency 2014-03-05 15:25:35 -05:00
dm-thin.c dm thin: fix to consistently zero-fill reads to unprovisioned blocks 2015-04-16 20:11:47 -04:00
dm-uevent.c md: Add in export.h for files using EXPORT_SYMBOL 2011-10-31 19:31:19 -04:00
dm-uevent.h dm: uevent generate events 2007-10-20 02:01:26 +01:00
dm-verity.c dm verity: fix biovecs hash calculation regression 2014-04-15 12:19:24 -04:00
dm-zero.c dm crypt, dm zero: update author name following legal name change 2014-07-10 16:44:14 -04:00
dm.c dm snapshot: suspend merging snapshot when doing exception handover 2015-04-16 20:13:10 -04:00
dm.h dm: allow active and inactive tables to share dm_devs 2014-10-05 20:03:35 -04:00
faulty.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
Kconfig dm: add era target 2014-03-27 16:56:23 -04:00
linear.c md: remove unwanted white space from md.c 2014-10-14 13:08:29 +11:00
linear.h md/linear: typedef removal: linear_conf_t -> struct linear_conf 2011-10-11 16:48:54 +11:00
Makefile dm: add era target 2014-03-27 16:56:23 -04:00
md.c md: use kzalloc() when bitmap is disabled 2015-08-20 17:33:11 -04:00
md.h md: remove unwanted white space from md.c 2014-10-14 13:08:29 +11:00
multipath.c md: remove unwanted white space from md.c 2014-10-14 13:08:29 +11:00
multipath.h md/multipath: typedef removal: multipath_conf_t -> struct mpconf 2011-10-11 16:48:57 +11:00
raid0.c md/raid0: fix restore to sector variable in raid0_make_request 2015-06-14 12:14:45 -04:00
raid0.h md: add proper merge_bvec handling to RAID0 and Linear. 2012-03-19 12:46:39 +11:00
raid1.c md/raid1: fix read balance when a drive is write-mostly. 2015-03-06 14:53:05 -08:00
raid1.h md: remove unwanted white space from md.c 2014-10-14 13:08:29 +11:00
raid5.c md/raid5: don't record new size if resize_stripes fails. 2015-06-10 13:42:37 -04:00
raid5.h md: remove unwanted white space from md.c 2014-10-14 13:08:29 +11:00
raid10.c md: remove unwanted white space from md.c 2014-10-14 13:08:29 +11:00
raid10.h MD RAID10: Improve redundancy for 'far' and 'offset' algorithms (part 1) 2013-02-26 11:55:30 +11:00