iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
d981cb5b9f
linux/block
History
Alexey Dobriyan 11bde98600 block, zoned: fix integer overflow with BLKRESETZONE et al 
Check for overflow in addition before checking for end-of-block-device.

Steps to reproduce:

	#define _GNU_SOURCE 1
	#include <sys/ioctl.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <fcntl.h>

	typedef unsigned long long __u64;

	struct blk_zone_range {
	        __u64 sector;
	        __u64 nr_sectors;
	};

	#define BLKRESETZONE    _IOW(0x12, 131, struct blk_zone_range)

	int main(void)
	{
	        int fd = open("/dev/nullb0", O_RDWR|O_DIRECT);
	        struct blk_zone_range zr = {4096, 0xfffffffffffff000ULL};
	        ioctl(fd, BLKRESETZONE, &zr);
	        return 0;
	}

BUG: KASAN: null-ptr-deref in submit_bio_wait+0x74/0xe0
Write of size 8 at addr 0000000000000040 by task a.out/1590

CPU: 8 PID: 1590 Comm: a.out Not tainted 5.6.0-rc1-00019-g359c92c02bfa #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190711_202441-buildvm-armv7-10.arm.fedoraproject.org-2.fc31 04/01/2014
Call Trace:
 dump_stack+0x76/0xa0
 __kasan_report.cold+0x5/0x3e
 kasan_report+0xe/0x20
 submit_bio_wait+0x74/0xe0
 blkdev_zone_mgmt+0x26f/0x2a0
 blkdev_zone_mgmt_ioctl+0x14b/0x1b0
 blkdev_ioctl+0xb28/0xe60
 block_ioctl+0x69/0x80
 ksys_ioctl+0x3af/0xa50

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Alexey Dobriyan (SK hynix) <adobriyan@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-12 09:10:52 -06:00
..
partitions partitions/ldm: fix spelling mistake "to" -> "too" 2020-01-23 11:41:45 -07:00
badblocks.c block: switch all files cleared marked as GPLv2 to SPDX tags 2019-04-30 16:11:57 -06:00
bfq-cgroup.c block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() 2020-03-06 07:00:58 -07:00
bfq-iosched.c block, bfq: clarify the goal of bfq_split_bfqq() 2020-02-03 06:58:15 -07:00
bfq-iosched.h block, bfq: get a ref to a group when adding it to a service tree 2020-02-03 06:58:15 -07:00
bfq-wf2q.c block, bfq: get a ref to a group when adding it to a service tree 2020-02-03 06:58:15 -07:00
bio-integrity.c block: fix memleak of bio integrity data 2019-12-05 11:38:36 -07:00
bio.c fs: move guard_bio_eod() after bio_set_op_attrs 2020-01-09 08:16:12 -07:00
blk-cgroup-rwstat.c blk-cgroup: separate out blkg_rwstat under CONFIG_BLK_CGROUP_RWSTAT 2019-11-07 12:28:13 -07:00
blk-cgroup-rwstat.h blk-cgroup: separate out blkg_rwstat under CONFIG_BLK_CGROUP_RWSTAT 2019-11-07 12:28:13 -07:00
blk-cgroup.c blk-cgroup: remove blkcg_drain_queue 2019-12-12 09:26:55 -07:00
blk-core.c block: cleanup for _blk/blk_rq_prep_clone 2020-03-12 07:42:54 -06:00
blk-exec.c block: account statistics for passthrough requests 2019-10-10 17:52:31 -06:00
blk-flush.c block: cleanup comment for blk_flush_complete_seq 2020-03-12 07:42:54 -06:00
blk-integrity.c block: centralize PI remapping logic to the block layer 2019-09-17 20:03:49 -06:00
blk-ioc.c block: Fix use-after-free issue accessing struct io_cq 2020-03-12 07:07:38 -06:00
blk-iocost.c blk-iocost: remove duplicated lines in comments 2020-03-12 08:02:20 -06:00
blk-iolatency.c blkcg: s/RQ_QOS_CGROUP/RQ_QOS_LATENCY/ 2019-08-28 21:17:08 -06:00
blk-lib.c block: fix 32 bit overflow in __blkdev_issue_discard() 2018-11-14 08:17:18 -07:00
blk-map.c block: fix memleak when __blk_rq_map_user_iov() is failed 2019-12-20 11:52:01 -07:00
blk-merge.c block: fix get_max_segment_size() overflow on 32bit arch 2020-01-14 13:37:40 -07:00
blk-mq-cpumap.c blk-mq: balance mapping between present CPUs and queues 2019-08-04 21:43:12 -06:00
blk-mq-debugfs-zoned.c block: Cleanup license notice 2019-01-17 21:21:40 -07:00
blk-mq-debugfs.c for-5.3/block-20190708 2019-07-09 10:45:06 -07:00
blk-mq-debugfs.h blk-mq: no need to check return value of debugfs_create functions 2019-06-13 03:00:30 -06:00
blk-mq-pci.c block: Fix blk_mq_*_map_queues() kernel-doc headers 2019-05-31 15:12:34 -06:00
blk-mq-rdma.c block: Fix blk_mq_*_map_queues() kernel-doc headers 2019-05-31 15:12:34 -06:00
blk-mq-sched.c blk-mq: insert passthrough request into hctx->dispatch directly 2020-02-24 18:50:48 -07:00
blk-mq-sched.h block: blk-mq: Remove blk_mq_sched_started_request and started_request 2019-07-23 07:25:09 -06:00
blk-mq-sysfs.c blk-mq: make sure that line break can be printed 2019-11-04 07:14:10 -07:00
blk-mq-tag.c blk-mq: Remove some unused function arguments 2020-02-26 10:34:41 -07:00
blk-mq-tag.h blk-mq: Remove some unused function arguments 2020-02-26 10:34:41 -07:00
blk-mq-virtio.c block: Fix blk_mq_*_map_queues() kernel-doc headers 2019-05-31 15:12:34 -06:00
blk-mq.c block: remove unneeded argument from blk_alloc_flush_queue 2020-03-12 07:42:54 -06:00
blk-mq.h blk-mq: Remove some unused function arguments 2020-02-26 10:34:41 -07:00
blk-pm.c block: bypass blk_set_runtime_active for uninitialized q->dev 2019-09-12 07:11:56 -06:00
blk-pm.h block: remove the queue_lock indirection 2018-11-15 12:17:28 -07:00
blk-rq-qos.c blk-wbt: fix performance regression in wbt scale_up/scale_down 2019-10-06 09:26:41 -06:00
blk-rq-qos.h blk-rq-qos: fix first node deletion of rq_qos_del() 2019-10-15 10:13:13 -06:00
blk-settings.c block: fix an integer overflow in logical block size 2020-01-15 21:43:09 -07:00
blk-softirq.c block: Don't disable interrupts in trigger_softirq() 2019-11-18 07:29:22 -07:00
blk-stat.c blk-stat: Optimise blk_stat_add() 2019-10-07 21:19:10 -06:00
blk-stat.h block: deactivate blk_stat timer in wbt_disable_default() 2018-12-12 06:47:51 -07:00
blk-sysfs.c block: Remove "dying" checks from sysfs callbacks 2019-10-07 08:31:59 -06:00
blk-throttle.c blk-cgroup: separate out blkg_rwstat under CONFIG_BLK_CGROUP_RWSTAT 2019-11-07 12:28:13 -07:00
blk-timeout.c block: add SPDX tags to block layer files missing licensing information 2019-04-30 16:12:03 -06:00
blk-wbt.c blk-wbt: fix performance regression in wbt scale_up/scale_down 2019-10-06 09:26:41 -06:00
blk-wbt.h block/rq_qos: implement rq_qos_ops->queue_depth_changed() 2019-08-28 21:17:07 -06:00
blk-zoned.c block, zoned: fix integer overflow with BLKRESETZONE et al 2020-03-12 09:10:52 -06:00
blk.h block: remove unneeded argument from blk_alloc_flush_queue 2020-03-12 07:42:54 -06:00
bounce.c block: remove the i argument to bio_for_each_segment_all 2019-04-30 09:26:13 -06:00
bsg-lib.c block: Fix the type of 'sts' in bsg_queue_rq() 2019-12-20 11:52:01 -07:00
bsg.c compat_ioctl: bsg: add handler 2020-01-03 09:33:21 +01:00
cmdline-parser.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
elevator.c Merge branch 'for-linus' into for-5.5/block 2019-11-07 12:27:19 -07:00
genhd.c block: add iostat counters for flush requests 2019-11-21 09:06:47 -07:00
ioctl.c compat_ioctl: simplify up block/ioctl.c 2020-01-03 09:42:52 +01:00
ioprio.c docs: block: convert to ReST 2019-07-15 09:20:27 -03:00
Kconfig block: Allow t10-pi to be modular 2020-01-06 20:59:04 -07:00
Kconfig.iosched blk-cgroup: separate out blkg_rwstat under CONFIG_BLK_CGROUP_RWSTAT 2019-11-07 12:28:13 -07:00
kyber-iosched.c blk-mq: remove blk_mq_put_ctx() 2019-07-02 21:03:27 -06:00
Makefile SCSI misc on 20200129 2020-01-29 18:16:16 -08:00
mq-deadline.c block: Introduce elevator features 2019-09-05 19:52:33 -06:00
opal_proto.h block: sed-opal: Change the check condition for regular session validity 2020-03-12 08:00:10 -06:00
partition-generic.c block: allow partitions on host aware zone devices 2020-01-26 09:59:08 -07:00
scsi_ioctl.c compat_ioctl: move CDROM_SEND_PACKET handling into scsi 2020-01-03 09:33:05 +01:00
sed-opal.c block: sed-opal: Change the check condition for regular session validity 2020-03-12 08:00:10 -06:00
t10-pi.c block: Allow t10-pi to be modular 2020-01-06 20:59:04 -07:00