| From 0d74e6a3b6421d98eeafbed26f29156d469bc0b5 Mon Sep 17 00:00:00 2001 |
| From: Mikulas Patocka <mpatocka@redhat.com> |
| Date: Wed, 13 Mar 2019 07:56:02 -0400 |
| Subject: dm integrity: change memcmp to strncmp in dm_integrity_ctr |
| |
| From: Mikulas Patocka <mpatocka@redhat.com> |
| |
| commit 0d74e6a3b6421d98eeafbed26f29156d469bc0b5 upstream. |
| |
| If the string opt_string is small, the function memcmp can access bytes |
| that are beyond the terminating nul character. In theory, it could cause |
| segfault, if opt_string were located just below some unmapped memory. |
| |
| Change from memcmp to strncmp so that we don't read bytes beyond the end |
| of the string. |
| |
| Cc: stable@vger.kernel.org # v4.12+ |
| Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> |
| Signed-off-by: Mike Snitzer <snitzer@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/md/dm-integrity.c | 8 ++++---- |
| 1 file changed, 4 insertions(+), 4 deletions(-) |
| |
| --- a/drivers/md/dm-integrity.c |
| +++ b/drivers/md/dm-integrity.c |
| @@ -3185,7 +3185,7 @@ static int dm_integrity_ctr(struct dm_ta |
| journal_watermark = val; |
| else if (sscanf(opt_string, "commit_time:%u%c", &val, &dummy) == 1) |
| sync_msec = val; |
| - else if (!memcmp(opt_string, "meta_device:", strlen("meta_device:"))) { |
| + else if (!strncmp(opt_string, "meta_device:", strlen("meta_device:"))) { |
| if (ic->meta_dev) { |
| dm_put_device(ti, ic->meta_dev); |
| ic->meta_dev = NULL; |
| @@ -3204,17 +3204,17 @@ static int dm_integrity_ctr(struct dm_ta |
| goto bad; |
| } |
| ic->sectors_per_block = val >> SECTOR_SHIFT; |
| - } else if (!memcmp(opt_string, "internal_hash:", strlen("internal_hash:"))) { |
| + } else if (!strncmp(opt_string, "internal_hash:", strlen("internal_hash:"))) { |
| r = get_alg_and_key(opt_string, &ic->internal_hash_alg, &ti->error, |
| "Invalid internal_hash argument"); |
| if (r) |
| goto bad; |
| - } else if (!memcmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) { |
| + } else if (!strncmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) { |
| r = get_alg_and_key(opt_string, &ic->journal_crypt_alg, &ti->error, |
| "Invalid journal_crypt argument"); |
| if (r) |
| goto bad; |
| - } else if (!memcmp(opt_string, "journal_mac:", strlen("journal_mac:"))) { |
| + } else if (!strncmp(opt_string, "journal_mac:", strlen("journal_mac:"))) { |
| r = get_alg_and_key(opt_string, &ic->journal_mac_alg, &ti->error, |
| "Invalid journal_mac argument"); |
| if (r) |
