kernel/linux.git/drivers/md/dm-ioctl.c, branch v7.2-rc5

dm-ioctl: fix a possible overflow in list_version_get_info

2026-07-10T12:40:51+00:00

sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the output buffer - info->vers->version[0], info->vers->version[1], info->vers->version[2] and info->vers->next. This can cause buffer overflow. Fix this buffer overflow by replacing "sizeof(tt->version)" with "sizeof(struct dm_target_versions)". Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-4.6 Cc: stable@vger.kernel.org

dm_early_create: fix freeing used table on dm_resume failure

2026-07-10T12:40:24+00:00

If dm_resume fails, the kernel attempts to free table with dm_table_destroy, but the table was already instantiated with dm_swap_table. This commit skips the call to dm_table_destroy in this case. Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-4.6 Fixes: 6bbc923dfcf5 ("dm: add support to directly boot to a mapped device") Cc: stable@vger.kernel.org

dm-ioctl: report an error if a device has no table

2026-05-18T12:27:11+00:00

When we send a message to a device that has no table, the return code was not set. The code would return "2", which is not considered a valid return value. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Reviewed-by: Benjamin Marzinski

dm-ima: remove new_map from dm_ima_measure_on_device_clear

2026-05-04T12:53:19+00:00

Now that two processes can't modify md->ima in dm_ima_measure_on_device_clear() at the same time, there's no need to track if an inactive table was actually removed. We might as well clean it up unconditionally, on the off chance that a previous ima measurement failed and left md->ima.inactive_table behind. Signed-off-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka

dm-ima: Fix UAF errors and measuring incorrect context

2026-05-04T12:53:09+00:00

the dm-ima code did not keep the dm_ima_measure_on_* functions from running at the same time. This could lead to various errors. If two processes were updating the device state, one could update the state first, but the other could measure the state first, causing the the current device state to appear incorrect. If a table load happened while a device was resuming, the IMA measurement could report the wrong table being active. And if two dm_ima_measure_on_* functions ran at the same time, one of them could free data that the other was accessing, causing a crash. All the core dm functions that call a dm_ima_measure_on_* function update the device state they want to measure under the _hash_lock, except for do_resume(). But holding the _hash_lock is not a good way to synchronize these functions. It's a global mutex, that is needed in many dm operations, and the dm_ima_measure_* functions can sleep, blocking any dm operation on any device that needs the _hash_lock. To serialize and order the IMA measurement functions, the dm_ima_measurements now has two counters, update_idx and measure_idx. update_idx is incremented while holding the _hash_lock and saved, along with the device name and uuid, in a dm_ima_context struct. Once the _hash_lock is dropped, the dm_ima_measure_* function is called. It waits until measure_idx matches the saved value of update_idx, ensuring that the updates and measurements happen in the same order if there are multiple processes changing the device at the same time. Then it measures the device, updates measure_idx, and wakes up any other process waiting to do a measurement. This makes sure that the measurements are serialized and done in the order that the _hash_lock was acquired in. But they only block other measurements for the same device, which are unlikely to happen at the same time. do_resume() is trickier, because it removes the inactive table while holding the _hash_lock, but doesn't hold it while updating md->map. To make sure it is also ordered, the IMA code grabs the _hash_lock after md->map is updated. Then it makes sure that the device isn't being removed and that another do_resume() hasn't already changed the active table again, and serializes like the other functions do. Signed-off-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka

dm-ima: Remove status_flags from dm_ima_measure_on_table_load()

2026-05-04T12:52:37+00:00

There is no status flag that is is used for STATUSTYPE_IMA type status() calls, and STATUSTYPE_IMA itself is not a valid status flag. Signed-off-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka

dm: fix a buffer overflow in ioctl processing

2026-04-09T18:49:04+00:00

Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn't check overflow, so outptr could point past the buffer end 4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number 6. With "remaining" being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally Reported-by: Tony Asleson Signed-off-by: Mikulas Patocka Reviewed-by: Bryn M. Reeves Cc: stable@vger.kernel.org

dm: make "dmsetup remove_all" interruptible

2026-03-18T18:27:30+00:00

The command "dmsetup remove_all" may take a long time (a minute for removing 1000 devices), so make it interruptible with fatal signals. For better readability, the bool arguments were changed to flags. Signed-off-by: Mikulas Patocka Reviewed-by: Bart Van Assche

dm: don't report warning when doing deferred remove

2026-03-18T14:39:48+00:00

If dm_hash_remove_all was called from dm_deferred_remove, it would write a warning "remove_all left %d open device(s)" if there are some other devices active. The warning is bogus, so let's disable it in this case. Signed-off-by: Mikulas Patocka Reported-by: Zdenek Kabelac Cc: stable@vger.kernel.org Fixes: 2c140a246dc0 ("dm: allow remove to be deferred")

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\