kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/md
History
Benjamin Randazzo 0624b99bab md: use kzalloc() when bitmap is disabled 
commit b6878d9e03 upstream.

In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a
mdu_bitmap_file_t called "file".

5769         file = kmalloc(sizeof(*file), GFP_NOIO);
5770         if (!file)
5771                 return -ENOMEM;

This structure is copied to user space at the end of the function.

5786         if (err == 0 &&
5787             copy_to_user(arg, file, sizeof(*file)))
5788                 err = -EFAULT

But if bitmap is disabled only the first byte of "file" is initialized
with zero, so it's possible to read some bytes (up to 4095) of kernel
space memory from user space. This is an information leak.

5775         /* bitmap disabled, zero the first byte and copy out */
5776         if (!mddev->bitmap_info.file)
5777                 file->pathname[0] = '\0';

Signed-off-by: Benjamin Randazzo <benjamin@randazzo.fr>
Signed-off-by: NeilBrown <neilb@suse.com>
Cc: Moritz Mühlenhoff <jmm@inutil.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
History 2015-08-20 15:33:39 +01:00
..
bcache bcache: Make sure to pass GFP_WAIT to mempool_alloc() 2015-01-16 14:34:51 +00:00
persistent-data dm btree: silence lockdep lock inversion in dm_btree_del() 2015-08-10 09:54:12 +01:00
bitmap.c md/bitmap: always wait for writes on unplug. 2015-01-15 10:44:12 +00:00
bitmap.h kernfs: s/sysfs_dirent/kernfs_node/ and rename its friends accordingly 2013-12-11 15:28:36 -08:00
dm-bio-prison.c dm bio prison: implement per bucket locking in the dm_bio_prison hash table 2014-06-11 16:48:54 -04:00
dm-bio-prison.h dm thin: return ENOSPC instead of EIO when error_if_no_space enabled 2014-06-03 13:44:08 -04:00
dm-bio-record.h dm: Refactor for new bio cloning/splitting 2013-11-23 22:33:55 -08:00
dm-bufio.c dm bufio: fix memleak when using a dm_buffer's inline bio 2015-01-12 15:44:07 +00:00
dm-bufio.h dm snapshot: use dm-bufio prefetch 2014-01-14 23:23:03 -05:00
dm-builtin.c dm sysfs: fix a module unload race 2014-01-14 23:23:04 -05:00
dm-cache-block-types.h dm cache: remove remainder of distinct discard block size 2014-03-27 16:56:23 -04:00
dm-cache-metadata.c dm cache: fix missing ERR_PTR returns and handling 2015-02-04 10:58:25 +00:00
dm-cache-metadata.h dm cache: fix a lock-inversion 2014-04-04 14:53:05 -04:00
dm-cache-policy-cleaner.c dm cache: policy change version from string to integer set 2013-03-20 17:21:27 +00:00
dm-cache-policy-internal.h dm cache: add remove_cblock method to policy interface 2013-11-11 11:37:50 -05:00
dm-cache-policy-mq.c dm cache mq: fix memory allocation failure for large cache devices 2014-02-28 12:18:29 -05:00
dm-cache-policy.c dm cache: add policy name to status output 2014-01-16 13:44:11 -05:00
dm-cache-policy.h dm cache: add policy name to status output 2014-01-16 13:44:11 -05:00
dm-cache-target.c dm cache: fix problematic dual use of a single migration count variable 2015-02-04 10:57:46 +00:00
dm-crypt.c dm crypt: use memzero_explicit for on-stack buffer 2015-01-12 15:44:12 +00:00
dm-delay.c Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block 2014-01-30 11:19:05 -08:00
dm-era-target.c dm era: check for a non-NULL metadata object before closing it 2014-06-03 13:44:08 -04:00
dm-exception-store.c dm: replace simple_strtoul 2012-07-27 15:07:59 +01:00
dm-exception-store.h dm snapshot: test chunk size against both origin and snapshot 2010-08-12 04:13:51 +01:00
dm-flakey.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-io.c dm io: deal with wandering queue limits when handling REQ_DISCARD and REQ_WRITE_SAME 2015-03-30 11:10:44 +01:00
dm-ioctl.c dm: allow remove to be deferred 2013-11-09 18:20:22 -05:00
dm-kcopyd.c dm: stop using WQ_NON_REENTRANT 2013-08-23 09:02:13 -04:00
dm-linear.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-log-userspace-base.c dm log userspace: allow mark requests to piggyback on flush requests 2014-01-21 23:46:27 -05:00
dm-log-userspace-transfer.c dm log userspace: fix memory leak in dm_ulog_tfr_init failure path 2014-11-17 14:11:44 +00:00
dm-log-userspace-transfer.h dm log: userspace add luid to distinguish between concurrent log instances 2009-09-04 20:40:34 +01:00
dm-log.c dm: use memweight() 2012-07-30 17:25:16 -07:00
dm-mpath.c dm mpath: fix IO hang due to logic bug in multipath_busy 2014-07-10 16:44:15 -04:00
dm-mpath.h dm mpath: remove is_active from struct dm_path 2008-10-10 13:36:58 +01:00
dm-path-selector.c md: Add module.h to all files using it implicitly 2011-10-31 19:31:18 -04:00
dm-path-selector.h dm mpath: add start_io and nr_bytes to path selectors 2009-06-22 10:12:27 +01:00
dm-queue-length.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-raid.c dm raid: ensure superblock's size matches device's logical block size 2014-11-20 12:01:49 +00:00
dm-raid1.c dm mirror: do not degrade the mirror on discard error 2015-03-02 15:04:24 +00:00
dm-region-hash.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-round-robin.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-service-time.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-snap-persistent.c dm snapshot: fix metadata corruption 2014-03-03 17:58:13 -05:00
dm-snap-transient.c md: Add in export.h for files using EXPORT_SYMBOL 2011-10-31 19:31:19 -04:00
dm-snap.c dm snapshot: suspend merging snapshot when doing exception handover 2015-03-30 11:10:44 +01:00
dm-stats.c dm stats: fix divide by zero if 'number_of_areas' arg is zero 2015-07-15 10:00:41 +01:00
dm-stats.h dm: add statistics support 2013-09-05 20:46:06 -04:00
dm-stripe.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-switch.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-sysfs.c dm sysfs: fix a module unload race 2014-01-14 23:23:04 -05:00
dm-table.c dm table: propagate QUEUE_FLAG_NO_SG_MERGE 2014-09-17 09:22:21 -07:00
dm-target.c dm: allow error target to replace bio-based and request-based targets 2013-09-05 20:46:05 -04:00
dm-thin-metadata.c dm thin metadata: do not allow the data block size to change 2014-07-15 14:05:26 -04:00
dm-thin-metadata.h dm thin: ensure user takes action to validate data and metadata consistency 2014-03-05 15:25:35 -05:00
dm-thin.c dm thin: fix to consistently zero-fill reads to unprovisioned blocks 2015-03-30 11:10:42 +01:00
dm-uevent.c md: Add in export.h for files using EXPORT_SYMBOL 2011-10-31 19:31:19 -04:00
dm-uevent.h dm: uevent generate events 2007-10-20 02:01:26 +01:00
dm-verity.c dm verity: fix biovecs hash calculation regression 2014-04-15 12:19:24 -04:00
dm-zero.c dm crypt, dm zero: update author name following legal name change 2014-07-10 16:44:14 -04:00
dm.c dm snapshot: suspend merging snapshot when doing exception handover 2015-03-30 11:10:44 +01:00
dm.h dm table: add dm_table_run_md_queue_async 2014-03-27 16:56:24 -04:00
faulty.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
Kconfig dm: add era target 2014-03-27 16:56:23 -04:00
linear.c block: Introduce new bio_split() 2013-11-23 22:33:57 -08:00
linear.h md/linear: typedef removal: linear_conf_t -> struct linear_conf 2011-10-11 16:48:54 +11:00
Makefile dm: add era target 2014-03-27 16:56:23 -04:00
md.c md: use kzalloc() when bitmap is disabled 2015-08-20 15:33:39 +01:00
md.h md/bitmap: don't abuse i_writecount for bitmap files. 2014-04-09 12:26:59 +10:00
multipath.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
multipath.h md/multipath: typedef removal: multipath_conf_t -> struct mpconf 2011-10-11 16:48:57 +11:00
raid0.c md/raid0: fix restore to sector variable in raid0_make_request 2015-05-27 09:41:36 +01:00
raid0.h md: add proper merge_bvec handling to RAID0 and Linear. 2012-03-19 12:46:39 +11:00
raid1.c md/raid1: fix test for 'was read error from last working device'. 2015-08-11 09:57:45 +01:00
raid1.h raid1: Rewrite the implementation of iobarrier. 2013-11-19 15:19:18 +11:00
raid5.c md/raid5: don't record new size if resize_stripes fails. 2015-05-28 10:00:00 +01:00
raid5.h raid5: add an option to avoid copy data from bio to stripe cache 2014-05-29 16:59:47 +10:00
raid10.c md/raid10: Fix memory leak when raid10 reshape completes. 2014-09-17 09:22:16 -07:00
raid10.h MD RAID10: Improve redundancy for 'far' and 'offset' algorithms (part 1) 2013-02-26 11:55:30 +11:00