Jens Axboe dd4fb6fc5d genhd: check for int overflow in disk_expand_part_tbl() ...

commit 5fabcb4c33 upstream.

We can get here from blkdev_ioctl() -> blkpg_ioctl() -> add_partition()
with a user passed in partno value. If we pass in 0x7fffffff, the
new target in disk_expand_part_tbl() overflows the 'int' and we
access beyond the end of ptbl->part[] and even write to it when we
do the rcu_assign_pointer() to assign the new partition.

Reported-by: David Ramos <daramos@stanford.edu>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2015-01-16 06:59:02 -08:00

..

partitions

partitions/efi.c: replace useless kzalloc's by kmalloc's

2013-04-30 08:34:25 +02:00

blk-cgroup.c

blkcg: don't call into policy draining if root_blkg is already gone

2014-09-17 09:04:02 -07:00

blk-cgroup.h

Update of blkg_stat and blkg_rwstat may happen in bh context. While u64_stats_fetch_retry is only preempt_disable on 32bit UP system. This is not enough to avoid preemption by bh and may read strange 64 bit value.

2013-12-11 22:36:27 -08:00

blk-core.c

blktrace: fix accounting of partially completed requests

2014-05-30 21:52:11 -07:00

blk-exec.c

Merge branch 'for-3.9/core' of git://git.kernel.dk/linux-block

2013-02-28 12:52:24 -08:00

blk-flush.c

Block: blk-flush: Fixed indent code style

2013-03-22 12:22:51 -06:00

blk-integrity.c

scatterlist: introduce sg_unmark_end

2013-03-20 15:43:04 +10:30

blk-ioc.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

blk-iopoll.c

…

blk-lib.c

block: add cond_resched() to potentially long running ioctl discard loop

2014-02-22 12:41:28 -08:00

blk-map.c

block: re-use existing 'reading' variable instead of checking direction again

2011-12-21 15:27:24 +01:00

blk-merge.c

scatterlist: introduce sg_unmark_end

2013-03-20 15:43:04 +10:30

blk-settings.c

block: fix alignment_offset math that assumes io_min is a power-of-2

2014-11-14 08:47:55 -08:00

blk-softirq.c

sched, block: Unify cache detection

2012-01-27 13:28:48 +01:00

blk-sysfs.c

block: avoid using uninitialized value in from queue_var_store

2013-04-03 21:53:57 +02:00

blk-tag.c

block: don't assume last put of shared tags is for the host

2014-07-31 12:53:48 -07:00

blk-throttle.c

block: Rename queue dead flag

2012-12-06 14:30:58 +01:00

blk-timeout.c

block: fix race between request completion and timeout handling

2013-11-29 11:11:50 -08:00

blk.h

block: __elv_next_request() shouldn't call into the elevator if bypassing

2014-02-22 12:41:28 -08:00

bsg-lib.c

bsg: Remove unused function bsg_goose_queue()

2012-12-06 14:33:02 +01:00

bsg.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

cfq-iosched.c

cfq-iosched: Fix wrong children_weight calculation

2014-10-05 14:54:08 -07:00

compat_ioctl.c

block: provide compat ioctl for BLKZEROOUT

2014-07-31 12:53:48 -07:00

deadline-iosched.c

elevator: Fix a race in elevator switching

2013-08-20 08:43:03 -07:00

elevator.c

elevator: acquire q->sysfs_lock in elevator_change()

2013-12-08 07:29:27 -08:00

genhd.c

genhd: check for int overflow in disk_expand_part_tbl()

2015-01-16 06:59:02 -08:00

ioctl.c

Merge branch 'for-3.7/core' of git://git.kernel.dk/linux-block

2012-10-11 09:04:23 +09:00

Kconfig

block: don't select PERCPU_RWSEM

2013-02-22 10:42:45 +01:00

Kconfig.iosched

blkcg: make CONFIG_BLK_CGROUP bool

2012-03-06 21:27:21 +01:00

Makefile

separate partition format handling from generic code

2012-01-03 22:54:06 -05:00

noop-iosched.c

elevator: Fix a race in elevator switching

2013-08-20 08:43:03 -07:00

partition-generic.c

block: Fix dev_t minor allocation lifetime

2014-10-05 14:54:12 -07:00

scsi_ioctl.c

scsi: Fix error handling in SCSI_IOCTL_SEND_COMMAND

2014-11-14 08:47:59 -08:00