[dm-devel] [PATCH stable] dm ioctl: fix out of bounds array access when no devices

[Sasha Levin]

On Wed, May 19, 2021 at 09:41:24AM +0200, Ard Biesheuvel wrote:
>From: Mikulas Patocka <mpatocka at redhat.com>
>
>commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.
>
>If there are not any dm devices, we need to zero the "dev" argument in
>the first structure dm_name_list. However, this can cause out of
>bounds write, because the "needed" variable is zero and len may be
>less than eight.
>
>Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
>too small to hold the "nl->dev" value.
>
>Signed-off-by: Mikulas Patocka <mpatocka at redhat.com>
>Reported-by: Dan Carpenter <dan.carpenter at oracle.com>
>Cc: stable at vger.kernel.org
>Signed-off-by: Mike Snitzer <snitzer at redhat.com>
>Signed-off-by: Ard Biesheuvel <ardb at kernel.org>
>---
>Please apply to 4.4.y and 4.9.y

We already carry this patch via the backport provided in
https://lore.kernel.org/stable/20210513094552.266451-1-nobuhiro1.iwamatsu@toshiba.co.jp/


-- 
Thanks,
Sasha