From d3684416c251f05cacf6dc0c2b4aa0acd48b4c2c Mon Sep 17 00:00:00 2001 From: Min Li Date: Tue, 27 Feb 2024 16:28:01 +0800 Subject: [PATCH] block: add check that partition length needs to be aligned with block size mainline inclusion from mainline-v6.8-rc1 commit 6f64f866aa1ae6975c95d805ed51d7e9433a0016 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EC9 CVE: CVE-2023-52458 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6f64f866aa1ae6975c95d805ed51d7e9433a0016 -------------------------------- Before calling add partition or resize partition, there is no check on whether the length is aligned with the logical block size. If the logical block size of the disk is larger than 512 bytes, then the partition size maybe not the multiple of the logical block size, and when the last sector is read, bio_truncate() will adjust the bio size, resulting in an IO error if the size of the read command is smaller than the logical block size.If integrity data is supported, this will also result in a null pointer dereference when calling bio_integrity_free. Cc: Signed-off-by: Min Li Reviewed-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230629142517.121241-1-min15.li@samsung.com Signed-off-by: Jens Axboe Conflict: block/ioctl.c commit 1a721de8489f ("block: don't add or resize partition on the disk with GENHD_FL_NO_PART") from mainline add check of GENHD_FL_NO_PART; commit 1ae011cf0aa0 ("block: Fix the partition start may overflow in add_partition()") from hulk add check of start and length. Signed-off-by: Li Lingfeng --- block/ioctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index f2a3524ed0ac..c8945df2e283 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -17,7 +17,7 @@ static int blkpg_do_ioctl(struct block_device *bdev, struct blkpg_partition __user *upart, int op) { struct blkpg_partition p; - long long start, length; + sector_t start, length; if (!capable(CAP_SYS_ADMIN)) return -EACCES; @@ -34,6 +34,9 @@ static int blkpg_do_ioctl(struct block_device *bdev, if (p.start < 0 || p.length <= 0 || p.start + p.length < 0) return -EINVAL; + /* Check that the partition is aligned to the block size */ + if (!IS_ALIGNED(p.start | p.length, bdev_logical_block_size(bdev))) + return -EINVAL; start = p.start >> SECTOR_SHIFT; length = p.length >> SECTOR_SHIFT; @@ -53,9 +56,6 @@ static int blkpg_do_ioctl(struct block_device *bdev, switch (op) { case BLKPG_ADD_PARTITION: - /* check if partition is aligned to blocksize */ - if (p.start & (bdev_logical_block_size(bdev) - 1)) - return -EINVAL; return bdev_add_partition(bdev, p.pno, start, length); case BLKPG_RESIZE_PARTITION: return bdev_resize_partition(bdev, p.pno, start, length); -- Gitee