Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 30dc4d7b authored by Mikulas Patocka's avatar Mikulas Patocka Committed by Greg Kroah-Hartman
Browse files

dm integrity: change memcmp to strncmp in dm_integrity_ctr 



commit 0d74e6a3b6421d98eeafbed26f29156d469bc0b5 upstream.

If the string opt_string is small, the function memcmp can access bytes
that are beyond the terminating nul character. In theory, it could cause
segfault, if opt_string were located just below some unmapped memory.

Change from memcmp to strncmp so that we don't read bytes beyond the end
of the string.

Cc: stable@vger.kernel.org # v4.12+
Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5be6e02c

drivers/md/dm-integrity.c

+4 −4
Original line number Diff line number Diff line
@@ -3174,7 +3174,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) 
			journal_watermark = val;

		else if (sscanf(opt_string, "commit_time:%u%c", &val, &dummy) == 1)

			sync_msec = val;

		else if (!memcmp(opt_string, "meta_device:", strlen("meta_device:"))) {

		else if (!strncmp(opt_string, "meta_device:", strlen("meta_device:"))) {

			if (ic->meta_dev) {

				dm_put_device(ti, ic->meta_dev);

				ic->meta_dev = NULL;
@@ -3193,17 +3193,17 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) 
				goto bad;

			}

			ic->sectors_per_block = val >> SECTOR_SHIFT;

		} else if (!memcmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {

		} else if (!strncmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {

			r = get_alg_and_key(opt_string, &ic->internal_hash_alg, &ti->error,

					    "Invalid internal_hash argument");

			if (r)

				goto bad;

		} else if (!memcmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {

		} else if (!strncmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {

			r = get_alg_and_key(opt_string, &ic->journal_crypt_alg, &ti->error,

					    "Invalid journal_crypt argument");

			if (r)

				goto bad;

		} else if (!memcmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {

		} else if (!strncmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {

			r = get_alg_and_key(opt_string, &ic->journal_mac_alg,  &ti->error,

					    "Invalid journal_mac argument");

			if (r)