diff options
| author | Mikulas Patocka <mpatocka@redhat.com> | 2020-03-22 20:42:21 +0100 |
|---|---|---|
| committer | Mike Snitzer <snitzer@redhat.com> | 2020-03-24 17:34:45 +0100 |
| commit | b93b6643e9b5a7f260b931e97f56ffa3fa65e26d (patch) | |
| tree | d5de73459b6cb1ee32351a953ddf90d77bcbeb85 /drivers/md | |
| parent | dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone() (diff) | |
| download | linux-b93b6643e9b5a7f260b931e97f56ffa3fa65e26d.tar.xz linux-b93b6643e9b5a7f260b931e97f56ffa3fa65e26d.zip | |
dm integrity: fix a crash with unusually large tag size
If the user specifies tag size larger than HASH_MAX_DIGESTSIZE,
there's a crash in integrity_metadata().
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Diffstat (limited to 'drivers/md')
| -rw-r--r-- | drivers/md/dm-integrity.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c index 66b8cfb83087..3cc12b55c34f 100644 --- a/drivers/md/dm-integrity.c +++ b/drivers/md/dm-integrity.c @@ -1519,7 +1519,7 @@ static void integrity_metadata(struct work_struct *w) struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io)); char *checksums; unsigned extra_space = unlikely(digest_size > ic->tag_size) ? digest_size - ic->tag_size : 0; - char checksums_onstack[HASH_MAX_DIGESTSIZE]; + char checksums_onstack[max((size_t)HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; unsigned sectors_to_process = dio->range.n_sectors; sector_t sector = dio->range.logical_sector; @@ -1749,7 +1749,7 @@ retry_kmap: } while (++s < ic->sectors_per_block); #ifdef INTERNAL_VERIFY if (ic->internal_hash) { - char checksums_onstack[max(HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; + char checksums_onstack[max((size_t)HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)]; integrity_sector_checksum(ic, logical_sector, mem + bv.bv_offset, checksums_onstack); if (unlikely(memcmp(checksums_onstack, journal_entry_tag(ic, je), ic->tag_size))) { |