Commit a9cb9f41 authored by Johannes Thumshirn's avatar Johannes Thumshirn Committed by Mike Snitzer

dm: don't call report zones for more than the user requested

Don't call report zones for more zones than the user actually requested,
otherwise this can lead to out-of-bounds accesses in the callback
functions.

Such a situation can happen if the target's ->report_zones() callback
function returns 0 because we've reached the end of the target and then
restart the report zones on the second target.

We're again calling into ->report_zones() and ultimately into the user
supplied callback function but when we're not subtracting the number of
zones already processed this may lead to out-of-bounds accesses in the
user callbacks.
Signed-off-by: default avatarJohannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: default avatarDamien Le Moal <damien.lemoal@wdc.com>
Fixes: d4100351 ("block: rework zone reporting")
Cc: stable@vger.kernel.org # v5.5+
Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
parent 4cb6f226
...@@ -503,7 +503,8 @@ static int dm_blk_report_zones(struct gendisk *disk, sector_t sector, ...@@ -503,7 +503,8 @@ static int dm_blk_report_zones(struct gendisk *disk, sector_t sector,
} }
args.tgt = tgt; args.tgt = tgt;
ret = tgt->type->report_zones(tgt, &args, nr_zones); ret = tgt->type->report_zones(tgt, &args,
nr_zones - args.zone_idx);
if (ret < 0) if (ret < 0)
goto out; goto out;
} while (args.zone_idx < nr_zones && } while (args.zone_idx < nr_zones &&
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment