lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 14 Aug 2021 08:17:17 +0530 From: Shreyansh Chouhan <chouhan.shreyansh630@...il.com> To: axboe@...nel.dk, hch@...radead.org Cc: Shreyansh Chouhan <chouhan.shreyansh630@...il.com>, linux-block@...r.kernel.org, linux-kernel@...r.kernel.org, syzbot+cf89d662483d6a1a0790@...kaller.appspotmail.com Subject: [RESEND PATCH v2] loop: fix setting arbitrarily large block size loop_validate_block_size took an unsigned short argument. Passing an argument with size greater than the size of unsigned short would cause an overflow and could potentially render the upper bound check on the block size useless, allowing to set an arbitrarily large block size. Reported-by: syzbot+cf89d662483d6a1a0790@...kaller.appspotmail.com Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@...il.com> --- Changes from v1: Fixed the spelling of reported-by tag. Fixed the commit message. drivers/block/loop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 9a758cf66507..635baff0dd66 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -236,7 +236,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio) * @bsize: size to validate */ static int -loop_validate_block_size(unsigned short bsize) +loop_validate_block_size(unsigned long bsize) { if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize)) return -EINVAL; -- 2.31.1
Powered by blists - more mailing lists