From: Zhang Tao <[email protected]>
allocate num + 1 for target and offset array, n_highs need num + 1
elements, the last element will be used for node lookup in function
dm_table_find_target.
Signed-off-by: Zhang Tao <[email protected]>
---
drivers/md/dm-table.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 7b6c3ee..fd7f604 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -160,20 +160,22 @@ static int alloc_targets(struct dm_table *t, unsigned int num)
{
sector_t *n_highs;
struct dm_target *n_targets;
+ unsigned int alloc_num;
/*
* Allocate both the target array and offset array at once.
* Append an empty entry to catch sectors beyond the end of
* the device.
*/
- n_highs = (sector_t *) dm_vcalloc(num + 1, sizeof(struct dm_target) +
+ alloc_num = num + 1;
+ n_highs = (sector_t *) dm_vcalloc(alloc_num, sizeof(struct dm_target) +
sizeof(sector_t));
if (!n_highs)
return -ENOMEM;
- n_targets = (struct dm_target *) (n_highs + num);
+ n_targets = (struct dm_target *) (n_highs + alloc_num);
- memset(n_highs, -1, sizeof(*n_highs) * num);
+ memset(n_highs, -1, sizeof(*n_highs) * alloc_num);
vfree(t->highs);
t->num_allocated = num;
--
1.8.3.1
Hi
I tested it and the bug is real - with some table sizes,
dm_table_find_target will access memory out of bounds if the sector
argument is beyond limit.
Your patch fixes some of these cases, but not all of them.
I used this script to test all possible table sizes:
#!/bin/bash -e
sync
dmsetup remove_all || true
rmmod dm_mod || true
>t.txt
for i in `seq 1 10000`; do
echo $i
echo $((i-1)) 1 error >>t.txt
dmsetup create error <t.txt
dmsetup remove error
done
and I modified dm_table_find_target to call dm_table_find_target with too
high sector number. Without your patch, it fails on table with 16 entries;
with your patch applied, it fails on 144 entries.
I'll make another patch that passes the test.
Mikulas
On Wed, 21 Aug 2019, Zhang Tao wrote:
> From: Zhang Tao <[email protected]>
>
> allocate num + 1 for target and offset array, n_highs need num + 1
> elements, the last element will be used for node lookup in function
> dm_table_find_target.
>
> Signed-off-by: Zhang Tao <[email protected]>
> ---
> drivers/md/dm-table.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
> index 7b6c3ee..fd7f604 100644
> --- a/drivers/md/dm-table.c
> +++ b/drivers/md/dm-table.c
> @@ -160,20 +160,22 @@ static int alloc_targets(struct dm_table *t, unsigned int num)
> {
> sector_t *n_highs;
> struct dm_target *n_targets;
> + unsigned int alloc_num;
>
> /*
> * Allocate both the target array and offset array at once.
> * Append an empty entry to catch sectors beyond the end of
> * the device.
> */
> - n_highs = (sector_t *) dm_vcalloc(num + 1, sizeof(struct dm_target) +
> + alloc_num = num + 1;
> + n_highs = (sector_t *) dm_vcalloc(alloc_num, sizeof(struct dm_target) +
> sizeof(sector_t));
> if (!n_highs)
> return -ENOMEM;
>
> - n_targets = (struct dm_target *) (n_highs + num);
> + n_targets = (struct dm_target *) (n_highs + alloc_num);
>
> - memset(n_highs, -1, sizeof(*n_highs) * num);
> + memset(n_highs, -1, sizeof(*n_highs) * alloc_num);
> vfree(t->highs);
>
> t->num_allocated = num;
> --
> 1.8.3.1
>
>
> --
> dm-devel mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/dm-devel
>
Currently, if we pass too high sector number to dm_table_find_target, it
returns zeroed dm_target structure and callers test if the structure is
zeroed with the macro dm_target_is_valid.
However, returning NULL is common practice to indicate errors.
This patch refactors the dm code, so that dm_table_find_target returns
NULL and its callers test the returned value for NULL. The macro
dm_target_is_valid is deleted. In alloc_targets, we no longer allocate an
extra zeroed target.
Signed-off-by: Mikulas Patocka <[email protected]>
---
drivers/md/dm-ioctl.c | 2 +-
drivers/md/dm-table.c | 8 +++-----
drivers/md/dm.c | 8 ++++----
drivers/md/dm.h | 5 -----
4 files changed, 8 insertions(+), 15 deletions(-)
Index: linux-2.6/drivers/md/dm.c
===================================================================
--- linux-2.6.orig/drivers/md/dm.c 2019-08-23 15:45:46.000000000 +0200
+++ linux-2.6/drivers/md/dm.c 2019-08-23 15:45:46.000000000 +0200
@@ -457,7 +457,7 @@ static int dm_blk_report_zones(struct ge
return -EIO;
tgt = dm_table_find_target(map, sector);
- if (!dm_target_is_valid(tgt)) {
+ if (!tgt) {
ret = -EIO;
goto out;
}
@@ -1072,7 +1072,7 @@ static struct dm_target *dm_dax_get_live
return NULL;
ti = dm_table_find_target(map, sector);
- if (!dm_target_is_valid(ti))
+ if (!ti)
return NULL;
return ti;
@@ -1572,7 +1572,7 @@ static int __split_and_process_non_flush
int r;
ti = dm_table_find_target(ci->map, ci->sector);
- if (!dm_target_is_valid(ti))
+ if (!ti)
return -EIO;
if (__process_abnormal_io(ci, ti, &r))
@@ -1748,7 +1748,7 @@ static blk_qc_t dm_process_bio(struct ma
if (!ti) {
ti = dm_table_find_target(map, bio->bi_iter.bi_sector);
- if (unlikely(!ti || !dm_target_is_valid(ti))) {
+ if (unlikely(!ti)) {
bio_io_error(bio);
return ret;
}
Index: linux-2.6/drivers/md/dm-ioctl.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-ioctl.c 2019-08-23 15:45:46.000000000 +0200
+++ linux-2.6/drivers/md/dm-ioctl.c 2019-08-23 15:45:46.000000000 +0200
@@ -1592,7 +1592,7 @@ static int target_message(struct file *f
}
ti = dm_table_find_target(table, tmsg->sector);
- if (!dm_target_is_valid(ti)) {
+ if (!ti) {
DMWARN("Target message sector outside device.");
r = -EINVAL;
} else if (ti->type->message)
Index: linux-2.6/drivers/md/dm-table.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-table.c 2019-08-23 15:45:46.000000000 +0200
+++ linux-2.6/drivers/md/dm-table.c 2019-08-23 15:47:18.000000000 +0200
@@ -163,10 +163,8 @@ static int alloc_targets(struct dm_table
/*
* Allocate both the target array and offset array at once.
- * Append an empty entry to catch sectors beyond the end of
- * the device.
*/
- n_highs = (sector_t *) dm_vcalloc(num + 1, sizeof(struct dm_target) +
+ n_highs = (sector_t *) dm_vcalloc(num, sizeof(struct dm_target) +
sizeof(sector_t));
if (!n_highs)
return -ENOMEM;
@@ -1359,7 +1357,7 @@ struct dm_target *dm_table_get_target(st
/*
* Search the btree for the correct target.
*
- * Caller should check returned pointer with dm_target_is_valid()
+ * Caller should check returned pointer for NULL
* to trap I/O beyond end of device.
*/
struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
@@ -1368,7 +1366,7 @@ struct dm_target *dm_table_find_target(s
sector_t *node;
if (unlikely(sector >= dm_table_get_size(t)))
- return &t->targets[t->num_targets];
+ return NULL;
for (l = 0; l < t->depth; l++) {
n = get_child(n, k);
Index: linux-2.6/drivers/md/dm.h
===================================================================
--- linux-2.6.orig/drivers/md/dm.h 2019-08-23 15:45:46.000000000 +0200
+++ linux-2.6/drivers/md/dm.h 2019-08-23 15:45:46.000000000 +0200
@@ -86,11 +86,6 @@ struct target_type *dm_get_immutable_tar
int dm_setup_md_queue(struct mapped_device *md, struct dm_table *t);
/*
- * To check the return value from dm_table_find_target().
- */
-#define dm_target_is_valid(t) ((t)->table)
-
-/*
* To check whether the target type is bio-based or not (request-based).
*/
#define dm_target_bio_based(t) ((t)->type->map != NULL)
If the sector number is too high, dm_table_find_target should return a
pointer to a zeroed dm_target structure (the caller should test it with
dm_target_is_valid).
However, for some table sizes, the code in dm_table_find_target that
performs btree lookup will access out of bound memory structures.
This patch fixes the bug by testing the sector number at the beginning of
dm_table_find_target. We add an "inline" keyword to the function
dm_table_get_size because this is hot path.
Signed-off-by: Mikulas Patocka <[email protected]>
Reported-by: Zhang Tao <[email protected]>
Fixes: 512875bd9661 ("dm: table detect io beyond device")
Cc: [email protected]
---
drivers/md/dm-table.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
Index: linux-2.6/drivers/md/dm-table.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-table.c 2019-08-23 13:40:51.000000000 +0200
+++ linux-2.6/drivers/md/dm-table.c 2019-08-23 15:43:19.000000000 +0200
@@ -1342,7 +1342,7 @@ void dm_table_event(struct dm_table *t)
}
EXPORT_SYMBOL(dm_table_event);
-sector_t dm_table_get_size(struct dm_table *t)
+inline sector_t dm_table_get_size(struct dm_table *t)
{
return t->num_targets ? (t->highs[t->num_targets - 1] + 1) : 0;
}
@@ -1367,6 +1367,9 @@ struct dm_target *dm_table_find_target(s
unsigned int l, n = 0, k = 0;
sector_t *node;
+ if (unlikely(sector >= dm_table_get_size(t)))
+ return &t->targets[t->num_targets];
+
for (l = 0; l < t->depth; l++) {
n = get_child(n, k);
node = get_node(t, l, n);