github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-23 07:11:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
4cbdd58dfa
linux/drivers/md
History
Mikulas Patocka fc79aeb86a dm-integrity: validate the superblock on resume 
dm_integrity_resume() re-reads the superblock from the device so that it
picks up the flags and the recalculate position. It performs no
validation on the result, while the constructor validates the superblock
it reads and sizes all the in-memory structures according to it. The user
may modify the superblock on the underlying device while the dm-integrity
device is suspended, so that the two no longer agree.

In particular, access_journal_data() shifts the journal entry index by
ic->sb->log2_sectors_per_block, while ic->journal_section_sectors and the
journal page list were computed with the value that was present at
constructor time. Increasing log2_sectors_per_block makes the index run
past the end of the journal, and dm-integrity then writes 512 bytes
through lowmem_page_address(NULL).

Snapshot the validated superblock in the constructor and refuse to resume
if any of the fields that describe the on-disk geometry changed.

Reported-by: syzbot+675c91651049ad042c5f@syzkaller.appspotmail.com
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 118ba36e44 ("dm-integrity: fix recalculation in bitmap mode")
Assisted-by: Claude:claude-opus-5
2026-10-01 13:18:00 +02:00
..
bcache bcache: fix uninitialized closure object 2026-04-03 05:11:08 -06:00
dm-pcache for-7.3/block-20260819 2026-08-20 13:55:16 -07:00
dm-vdo dm vdo indexer: embed geometry in parent structures 2026-07-28 14:34:47 +02:00
persistent-data dm array: reject an array block whose value size is not the caller's 2026-08-04 10:19:29 +02:00
dm-audit.c
dm-audit.h
dm-bio-prison-v1.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-bio-prison-v1.h
dm-bio-prison-v2.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-bio-prison-v2.h
dm-bio-record.h
dm-bufio.c dm-io: report non-retryable errors separatedly 2026-07-27 23:09:28 +02:00
dm-builtin.c
dm-cache-background-tracker.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-cache-background-tracker.h
dm-cache-block-types.h
dm-cache-metadata.c dm cache metadata: fix memory leak on metadata abort retry 2026-03-09 14:53:39 +01:00
dm-cache-metadata.h dm cache: prevent entering passthrough mode after unclean shutdown 2026-03-02 16:50:18 +01:00
dm-cache-policy-internal.h
dm-cache-policy-smq.c - small cleanups in dm-vdo, dm-raid, dm-cache, dm-zoned-metadata 2026-06-16 13:20:54 +05:30
dm-cache-policy.c
dm-cache-policy.h
dm-cache-target.c dm cache: fix demotion stats in passthrough mode 2026-09-01 15:22:36 +02:00
dm-clone-metadata.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-clone-metadata.h
dm-clone-target.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-core.h
dm-crypt.c dm-crypt: reject the lmk IV mode with AEAD ciphers 2026-09-21 13:54:29 +02:00
dm-delay.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-dust.c dm dust: make badblock messages target-relative 2026-08-06 13:33:30 +02:00
dm-ebs-target.c dm-ebs: fix incorrect device offset check in ebs_ctr() 2026-09-02 17:01:13 +02:00
dm-era-target.c dm-era: fix shadowed superblock leak on take-snap failure 2026-08-06 13:55:01 +02:00
dm-exception-store.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-exception-store.h
dm-flakey.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-ima.c dm-ima: use active table's size if available 2026-05-04 14:53:52 +02:00
dm-ima.h dm-ima: use active table's size if available 2026-05-04 14:53:52 +02:00
dm-init.c dm init: ensure device probing has finished in dm-mod.waitfor= 2026-03-18 15:36:33 +01:00
dm-inlinecrypt.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
dm-integrity.c dm-integrity: validate the superblock on resume 2026-10-01 13:18:00 +02:00
dm-io-rewind.c block: rename bi_bvec_done 2026-08-06 06:47:33 -06:00
dm-io-tracker.h
dm-io.c dm-io: report non-retryable errors separatedly 2026-07-27 23:09:28 +02:00
dm-ioctl.c dm: fix reading free memory in do_resume 2026-09-30 14:14:38 +02:00
dm-kcopyd.c dm-io: report non-retryable errors separatedly 2026-07-27 23:09:28 +02:00
dm-linear.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-log-userspace-base.c dm raid1: reserve space for NUL-terminator in build_constructor_string() 2026-07-20 15:27:42 +02:00
dm-log-userspace-transfer.c
dm-log-userspace-transfer.h
dm-log-writes.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-log.c dm-io: report non-retryable errors separatedly 2026-07-27 23:09:28 +02:00
dm-mpath.c dm-mpath: don't stop probing paths at presuspend 2026-03-02 16:54:36 +01:00
dm-mpath.h
dm-path-selector.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-path-selector.h
dm-ps-historical-service-time.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-ps-io-affinity.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-ps-queue-length.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-ps-round-robin.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-ps-service-time.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-raid.c dm-raid: only requeue bios when dm is suspending 2026-05-31 19:09:17 +08:00
dm-raid1.c dm-io: report non-retryable errors separatedly 2026-07-27 23:09:28 +02:00
dm-region-hash.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-rq.c block: switch numa_node to int in blk_mq_hw_ctx and init_request 2026-05-26 11:01:55 -06:00
dm-rq.h
dm-snap-persistent.c dm-io: report non-retryable errors separatedly 2026-07-27 23:09:28 +02:00
dm-snap-transient.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-snap.c dm-snap: reject the transient exception store for snapshot-merge 2026-09-30 14:16:56 +02:00
dm-stats.c dm-stats: fix a crash if allocation of per-cpu data fails 2026-08-04 10:20:10 +02:00
dm-stats.h
dm-stripe.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-switch.c dm-switch: use WRITE_ONCE() in switch_region_table_write() 2026-07-15 15:52:19 +02:00
dm-sysfs.c
dm-table.c dm-table: fix spelling 2026-07-13 21:33:10 +02:00
dm-target.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-thin-metadata.c dm thin metadata: fix superblock refcount leak on snapshot shadow failure 2026-07-11 15:18:51 +02:00
dm-thin-metadata.h
dm-thin.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-uevent.c
dm-uevent.h
dm-unstripe.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-verity-fec.c dm-verity: fix buffer overflow in FEC calculation 2026-07-08 22:33:34 +02:00
dm-verity-fec.h dm-verity: fix buffer overflow in FEC calculation 2026-07-08 22:33:34 +02:00
dm-verity-loadpin.c dm-verity: fix a possible NULL pointer dereference 2026-07-10 14:41:43 +02:00
dm-verity-target.c dm-io: report non-retryable errors separatedly 2026-07-27 23:09:28 +02:00
dm-verity-verify-sig.c
dm-verity-verify-sig.h
dm-verity.h dm-verity: make error counter atomic 2026-07-10 14:42:33 +02:00
dm-writecache.c - 6 minor cleanups found by Claude Opus 4.6 2026-08-19 12:35:15 -07:00
dm-zero.c
dm-zone.c
dm-zoned-metadata.c dm: use clear_and_wake_up_bit() in device mapper 2026-07-15 15:58:05 +02:00
dm-zoned-reclaim.c dm: use clear_and_wake_up_bit() in device mapper 2026-07-15 15:58:05 +02:00
dm-zoned-target.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dm-zoned.h
dm.c dm: fix race when loading and unloading a table 2026-07-27 22:27:07 +02:00
dm.h
Kconfig dm-inlinecrypt: add target for inline block device encryption 2026-05-12 12:58:13 +02:00
Makefile dm-inlinecrypt: add target for inline block device encryption 2026-05-12 12:58:13 +02:00
md-autodetect.c
md-bitmap.c md/md-llbitmap: add reshape range mapping helpers 2026-08-07 14:43:35 +08:00
md-bitmap.h md/md-llbitmap: add reshape range mapping helpers 2026-08-07 14:43:35 +08:00
md-cluster.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
md-cluster.h
md-linear.c md: remove REQ_NOWAIT support from raid1/10/456 2026-07-30 18:46:32 +08:00
md-llbitmap.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
md.c md: skip discard on unsupported member devices 2026-08-07 16:36:32 +08:00
md.h md: add exact bitmap mapping and reshape hooks 2026-08-07 14:43:34 +08:00
raid1-10.c md: remove REQ_NOWAIT support from raid1/10/456 2026-07-30 18:46:32 +08:00
raid1.c md/raid1: don't set array_frozen in raid1_takeover() 2026-08-07 16:49:22 +08:00
raid1.h
raid5-cache.c md/raid5: validate payload size before accessing journal metadata 2026-04-07 13:09:22 +08:00
raid5-log.h
raid5-ppl.c md/raid5-ppl: fix use-after-free in ppl_do_flush() 2026-07-30 16:05:16 +08:00
raid5.c md/raid5: split reshape bios before bitmap accounting 2026-08-07 14:43:36 +08:00
raid5.h md/raid5: validate discard support at request time 2026-06-21 03:16:24 +08:00
raid10.c md/raid10: fix still_degraded being inverted in raid10_sync_request() 2026-08-07 15:25:32 +08:00
raid10.h md/raid10: resize r10bio_pool for reshape 2026-07-31 05:40:46 +08:00
raid0.c md: remove REQ_NOWAIT support from raid1/10/456 2026-07-30 18:46:32 +08:00
raid0.h