github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

dm-pcache: only hand out initialized cache segments

Browse Source 
get_cache_segment() scans the segment map up to cache->n_segs, the
physical device segment count, but cache_segs_init() only initializes
the first cache_info->n_segs segments. A crafted image with
cache_info->n_segs smaller than the device count leaves the remaining
pcache_cache_segment structs zeroed (segment.data == NULL), and the
allocator can hand one to cache_kset_close(), which writes through the
returned segment's data pointer with no NULL check.

Bound the allocator's search to cache_info->n_segs so only initialized
segments are ever returned. A conforming cache sets n_segs equal to the
device segment count, so this rejects nothing legitimate.

Fixes: 1d57628ff9 ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
This commit is contained in:
Bryam Vargas 2026-07-17 06:27:04 -05:00 committed by Mikulas Patocka
parent 58d620ee9e
commit 2df0fc042e
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/md/dm-pcache/cache_segment.c
View File

@ -243,8 +243,16 @@ struct pcache_cache_segment *get_cache_segment(struct pcache_cache *cache)
spin_lock(&cache->seg_map_lock);
again:
seg_id = find_next_zero_bit(cache->seg_map, cache->n_segs, cache->last_cache_seg);
if (seg_id == cache->n_segs) {
/*
* Only allocate initialized segments. cache_segs_init() initializes
* cache_info.n_segs of the cache->n_segs device segments; a forged
* smaller cache_info.n_segs leaves the rest as zeroed structs whose data
* pointer is NULL. Bounding the search to cache_info.n_segs keeps such a
* segment from reaching cache_kset_close(), which writes through it.
*/
seg_id = find_next_zero_bit(cache->seg_map, cache->cache_info.n_segs,
cache->last_cache_seg);
if (seg_id == cache->cache_info.n_segs) {
/* reset the hint of ->last_cache_seg and retry */
if (cache->last_cache_seg) {
cache->last_cache_seg = 0;