github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

dm-pcache: validate on-media seg_num against the cache device size

Browse Source 
seg_num is read from the crc32c-only superblock, so whoever supplies the
cache device on a table load (CAP_SYS_ADMIN) controls it. It sizes
cache->segments[] and is the value every later on-media segment id is
bounded against, yet it is never checked against the device. Because
cache_dev->mapping is the direct map of the pmem, CACHE_DEV_SEGMENT() for
a segment id past the device resolves to ordinary kernel memory beyond
the mapping; a new-cache init reaching such an id has cache_seg_init() ->
cache_dev_zero_range() memset() 12 KiB over that memory -- an
out-of-bounds write into the kernel heap at table load. A zero seg_num
makes the segment allocations ZERO_SIZE_PTR.

Reject a seg_num that is zero, larger than the device can hold, or larger
than PCACHE_CACHE_SEGS_MAX before it is used.

Fixes: 1d57628ff9 ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
This commit is contained in:
Bryam Vargas 2026-07-17 06:27:02 -05:00 committed by Mikulas Patocka
parent becf07e2b0
commit 62d92e45ab
1 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/md/dm-pcache/cache_dev.c
View File

@ -242,6 +242,8 @@ int cache_dev_start(struct dm_pcache *pcache)
struct pcache_cache_dev *cache_dev = &pcache->cache_dev;
struct pcache_sb sb;
bool format = false;
u32 seg_num;
u64 max_segs;
int ret;
mutex_init(&cache_dev->seg_lock);
@ -269,7 +271,25 @@ int cache_dev_start(struct dm_pcache *pcache)
goto dax_release;
cache_dev->sb_flags = le32_to_cpu(sb.flags);
ret = cache_dev_init(cache_dev, le32_to_cpu(sb.seg_num));
/*
* seg_num is read from the crc32c-only superblock, so whoever supplies
* the cache device controls it. It is the ceiling every later on-media
* segment id is validated against, so bound it against what the device
* physically holds before it is trusted, or a forged seg_num lets a
* segment id address past the DAX mapping.
*/
seg_num = le32_to_cpu(sb.seg_num);
max_segs = (bdev_nr_bytes(cache_dev->dm_dev->bdev) - PCACHE_SEGMENTS_OFF) /
PCACHE_SEG_SIZE;
if (seg_num == 0 || seg_num > max_segs || seg_num > PCACHE_CACHE_SEGS_MAX) {
pcache_dev_err(pcache, "invalid seg_num %u from cache device (device holds %llu, max %u)\n",
seg_num, max_segs, (u32)PCACHE_CACHE_SEGS_MAX);
ret = -EIO;
goto dax_release;
}
ret = cache_dev_init(cache_dev, seg_num);
if (ret)
goto dax_release;