[3.5.y.z,extended,stable] Patch "dm: fix truncated status strings" has been added to staging queue

From: Mikulas Patocka <mpatocka@redhat.com>

This is a note to let you know that I have just added a patch titled

    dm: fix truncated status strings

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

------

From 1dc28449ac778522dc19913d976d5a5ef0dc2291 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Fri, 1 Mar 2013 22:45:44 +0000
Subject: dm: fix truncated status strings

commit fd7c092e711ebab55b2688d3859d95dfd0301f73 upstream.

Avoid returning a truncated table or status string instead of setting
the DM_BUFFER_FULL_FLAG when the last target of a table fills the
buffer.

When processing a table or status request, the function retrieve_status
calls ti->type->status. If ti->type->status returns non-zero,
retrieve_status assumes that the buffer overflowed and sets
DM_BUFFER_FULL_FLAG.

However, targets don't return non-zero values from their status method
on overflow. Most targets returns always zero.

If a buffer overflow happens in a target that is not the last in the
table, it gets noticed during the next iteration of the loop in
retrieve_status; but if a buffer overflow happens in the last target, it
goes unnoticed and erroneously truncated data is returned.

In the current code, the targets behave in the following way:
* dm-crypt returns -ENOMEM if there is not enough space to store the
  key, but it returns 0 on all other overflows.
* dm-thin returns errors from the status method if a disk error happened.
  This is incorrect because retrieve_status doesn't check the error
  code, it assumes that all non-zero values mean buffer overflow.
* all the other targets always return 0.

This patch changes the ti->type->status function to return void (because
most targets don't use the return code). Overflow is detected in
retrieve_status: if the status method fills up the remaining space
completely, it is assumed that buffer overflow happened.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Cc: Mikulas Patocka <mpatocka@redhat.com>
[ luis: backported to 3.5: based on Mikulas backport to 3.4 ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/md/dm-crypt.c         | 37 +++++-----------------
 drivers/md/dm-delay.c         |  6 ++--
 drivers/md/dm-flakey.c        |  5 ++-
 drivers/md/dm-ioctl.c         | 18 +++++++----
 drivers/md/dm-linear.c        |  5 ++-
 drivers/md/dm-mpath.c         |  6 ++--
 drivers/md/dm-raid.c          |  6 ++--
 drivers/md/dm-raid1.c         |  6 ++--
 drivers/md/dm-snap.c          | 12 +++----
 drivers/md/dm-stripe.c        |  5 ++-
 drivers/md/dm-thin.c          | 74 +++++++++++++++++++++++++++----------------
 drivers/md/dm-verity.c        |  6 ++--
 include/linux/device-mapper.h |  4 +--
 13 files changed, 87 insertions(+), 103 deletions(-)

--
1.8.3.2

[3.5.y.z,extended,stable] Patch "dm: fix truncated status strings" has been added to staging queue

Commit Message

Patch