diff options
| author | Mikulas Patocka <mpatocka@redhat.com> | 2026-07-09 21:31:47 +0200 |
|---|---|---|
| committer | Mikulas Patocka <mpatocka@redhat.com> | 2026-07-10 14:40:51 +0200 |
| commit | 76c6f845dc0c614304a6e6ee619b552f97cf24b3 (patch) | |
| tree | 5ecbae47ec8b8a22a98380c8b5e8cf50cca2c880 /drivers | |
| parent | 366665416f20527ff7cad548a32d1ddf23195740 (diff) | |
| download | linux-next-76c6f845dc0c614304a6e6ee619b552f97cf24b3.tar.gz linux-next-76c6f845dc0c614304a6e6ee619b552f97cf24b3.zip | |
dm-ioctl: fix a possible overflow in list_version_get_info
sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the
output buffer - info->vers->version[0], info->vers->version[1],
info->vers->version[2] and info->vers->next. This can cause buffer
overflow.
Fix this buffer overflow by replacing "sizeof(tt->version)" with
"sizeof(struct dm_target_versions)".
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-4.6
Cc: stable@vger.kernel.org
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/md/dm-ioctl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 1fa8bf835be0..61af2a437a05 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -785,7 +785,7 @@ static void list_version_get_info(struct target_type *tt, void *param) struct vers_iter *info = param; /* Check space - it might have changed since the first iteration */ - if ((char *)info->vers + sizeof(tt->version) + strlen(tt->name) + 1 > info->end) { + if ((char *)info->vers + sizeof(struct dm_target_versions) + strlen(tt->name) + 1 > info->end) { info->flags = DM_BUFFER_FULL_FLAG; return; } |