kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/md
History
Adrian Salido aebe2f15c3 dm ioctl: prevent stack leak in dm ioctl call 
commit 4617f564c0 upstream.

When calling a dm ioctl that doesn't process any data
(IOCTL_FLAGS_NO_PARAMS), the contents of the data field in struct
dm_ioctl are left initialized.  Current code is incorrectly extending
the size of data copied back to user, causing the contents of kernel
stack to be leaked to user.  Fix by only copying contents before data
and allow the functions processing the ioctl to override.

Signed-off-by: Adrian Salido <salidoa@google.com>
Reviewed-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2017-08-26 02:14:40 +01:00
..
bcache bcache: RESERVE_PRIO is too small by one when prio_buckets() is a power of two. 2016-11-20 01:17:12 +00:00
persistent-data dm btree: fix for dm_btree_find_lowest_key() 2017-08-26 02:14:38 +01:00
bitmap.c md/bitmap: return an error when bitmap superblock is corrupt. 2015-08-27 12:08:08 +01:00
bitmap.h kernfs: s/sysfs_dirent/kernfs_node/ and rename its friends accordingly 2013-12-11 15:28:36 -08:00
dm-bio-prison.c dm bio prison: implement per bucket locking in the dm_bio_prison hash table 2014-06-11 16:48:54 -04:00
dm-bio-prison.h dm thin: return ENOSPC instead of EIO when error_if_no_space enabled 2014-06-03 13:44:08 -04:00
dm-bio-record.h dm: Refactor for new bio cloning/splitting 2013-11-23 22:33:55 -08:00
dm-bufio.c dm bufio: fix memleak when using a dm_buffer's inline bio 2015-01-12 15:44:07 +00:00
dm-bufio.h dm snapshot: use dm-bufio prefetch 2014-01-14 23:23:03 -05:00
dm-builtin.c dm sysfs: fix a module unload race 2014-01-14 23:23:04 -05:00
dm-cache-block-types.h dm cache: remove remainder of distinct discard block size 2014-03-27 16:56:23 -04:00
dm-cache-metadata.c dm cache: fix missing ERR_PTR returns and handling 2015-02-04 10:58:25 +00:00
dm-cache-metadata.h dm cache: fix a lock-inversion 2014-04-04 14:53:05 -04:00
dm-cache-policy-cleaner.c dm cache: fix NULL pointer when switching from cleaner policy 2015-10-30 13:59:29 +00:00
dm-cache-policy-internal.h dm cache: add remove_cblock method to policy interface 2013-11-11 11:37:50 -05:00
dm-cache-policy-mq.c dm cache mq: fix memory allocation failure for large cache devices 2014-02-28 12:18:29 -05:00
dm-cache-policy.c dm cache: add policy name to status output 2014-01-16 13:44:11 -05:00
dm-cache-policy.h dm cache: add policy name to status output 2014-01-16 13:44:11 -05:00
dm-cache-target.c dm cache: fix corruption seen when using cache > 2TB 2017-06-05 21:17:09 +01:00
dm-crypt.c dm crypt: mark key as invalid until properly loaded 2017-03-16 02:26:24 +00:00
dm-delay.c Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block 2014-01-30 11:19:05 -08:00
dm-era-target.c dm era: save spacemap metadata root after the pre-commit 2017-08-26 02:14:38 +01:00
dm-exception-store.c dm: replace simple_strtoul 2012-07-27 15:07:59 +01:00
dm-exception-store.h dm snapshot: fix hung bios when copy error occurs 2016-02-02 19:09:21 +00:00
dm-flakey.c dm flakey: error READ bios during the down_interval 2016-11-20 01:17:03 +00:00
dm-io.c dm io: deal with wandering queue limits when handling REQ_DISCARD and REQ_WRITE_SAME 2015-03-30 11:10:44 +01:00
dm-ioctl.c dm ioctl: prevent stack leak in dm ioctl call 2017-08-26 02:14:40 +01:00
dm-kcopyd.c dm: stop using WQ_NON_REENTRANT 2013-08-23 09:02:13 -04:00
dm-linear.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-log-userspace-base.c dm log userspace: allow mark requests to piggyback on flush requests 2014-01-21 23:46:27 -05:00
dm-log-userspace-transfer.c dm log userspace: fix memory leak in dm_ulog_tfr_init failure path 2014-11-17 14:11:44 +00:00
dm-log-userspace-transfer.h dm log: userspace add luid to distinguish between concurrent log instances 2009-09-04 20:40:34 +01:00
dm-log.c dm: use memweight() 2012-07-30 17:25:16 -07:00
dm-mpath.c dm mpath: check if path's request_queue is dying in activate_path() 2017-02-23 03:54:00 +00:00
dm-mpath.h dm mpath: remove is_active from struct dm_path 2008-10-10 13:36:58 +01:00
dm-path-selector.c md: Add module.h to all files using it implicitly 2011-10-31 19:31:18 -04:00
dm-path-selector.h dm mpath: add start_io and nr_bytes to path selectors 2009-06-22 10:12:27 +01:00
dm-queue-length.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-raid.c dm raid: fix round up of default region size 2015-10-30 13:59:28 +00:00
dm-raid1.c dm mirror: do not degrade the mirror on discard error 2015-03-02 15:04:24 +00:00
dm-region-hash.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-round-robin.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-service-time.c dm: reject trailing characters in sccanf input 2012-03-28 18:41:26 +01:00
dm-snap-persistent.c dm snapshot: fix hung bios when copy error occurs 2016-02-02 19:09:21 +00:00
dm-snap-transient.c dm snapshot: fix hung bios when copy error occurs 2016-02-02 19:09:21 +00:00
dm-snap.c dm snapshot: fix hung bios when copy error occurs 2016-02-02 19:09:21 +00:00
dm-stats.c dm stats: fix divide by zero if 'number_of_areas' arg is zero 2015-07-15 10:00:41 +01:00
dm-stats.h dm: add statistics support 2013-09-05 20:46:06 -04:00
dm-stripe.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-switch.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-sysfs.c dm sysfs: fix a module unload race 2014-01-14 23:23:04 -05:00
dm-table.c dm table: fix missing dm_put_target_type() in dm_table_add_target() 2017-02-23 03:54:20 +00:00
dm-target.c dm: allow error target to replace bio-based and request-based targets 2013-09-05 20:46:05 -04:00
dm-thin-metadata.c dm thin metadata: fix bug when taking a metadata snapshot 2016-01-18 22:27:24 +00:00
dm-thin-metadata.h dm thin: ensure user takes action to validate data and metadata consistency 2014-03-05 15:25:35 -05:00
dm-thin.c dm thin: fix race condition when destroying thin pool workqueue 2016-02-02 17:38:40 +00:00
dm-uevent.c md: Add in export.h for files using EXPORT_SYMBOL 2011-10-31 19:31:19 -04:00
dm-uevent.h dm: uevent generate events 2007-10-20 02:01:26 +01:00
dm-verity.c dm verity: fix biovecs hash calculation regression 2014-04-15 12:19:24 -04:00
dm-zero.c dm crypt, dm zero: update author name following legal name change 2014-07-10 16:44:14 -04:00
dm.c dm rq: fix a race condition in rq_completed() 2017-03-16 02:26:21 +00:00
dm.h dm table: add dm_table_run_md_queue_async 2014-03-27 16:56:24 -04:00
faulty.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
Kconfig scsi_dh: fix randconfig build error 2015-09-30 13:20:52 +01:00
linear.c md linear: fix a race between linear_add() and linear_congested() 2017-06-05 21:17:07 +01:00
linear.h md linear: fix a race between linear_add() and linear_congested() 2017-06-05 21:17:07 +01:00
Makefile dm: add era target 2014-03-27 16:56:23 -04:00
md.c md: ensure md devices are freed before module is unloaded. 2017-06-05 21:17:08 +01:00
md.h md/bitmap: don't abuse i_writecount for bitmap files. 2014-04-09 12:26:59 +10:00
multipath.c md: multipath: don't hardcopy bio in .make_request path 2016-05-01 00:06:00 +02:00
multipath.h md/multipath: typedef removal: multipath_conf_t -> struct mpconf 2011-10-11 16:48:57 +11:00
raid0.c md/raid0: apply base queue limits *before* disk_stack_limits 2015-12-13 17:49:47 +00:00
raid0.h md: add proper merge_bvec handling to RAID0 and Linear. 2012-03-19 12:46:39 +11:00
raid1.c md/raid1: submit_bio_wait() returns 0 on success 2015-11-16 11:27:10 +00:00
raid1.h raid1: Rewrite the implementation of iobarrier. 2013-11-19 15:19:18 +11:00
raid5.c md/raid5: limit request size according to implementation limits 2017-03-16 02:26:26 +00:00
raid5.h raid5: add an option to avoid copy data from bio to stripe cache 2014-05-29 16:59:47 +10:00
raid10.c md/raid1/10: fix potential deadlock 2017-07-18 18:40:10 +01:00
raid10.h MD RAID10: Improve redundancy for 'far' and 'offset' algorithms (part 1) 2013-02-26 11:55:30 +11:00