From 9f9722bb2644cfb63c2cb54dde0ab869a5f6eece Mon Sep 17 00:00:00 2001 From: Tom Marshall Date: Sat, 16 Nov 2019 20:29:06 -0800 Subject: [PATCH] Validate lbat element length on read --- dm-compress/lbd.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/dm-compress/lbd.c b/dm-compress/lbd.c index 006f72d..cce4ef7 100644 --- a/dm-compress/lbd.c +++ b/dm-compress/lbd.c @@ -431,6 +431,12 @@ lbd_read(struct lbd* lbd) nr_pblk = (lbd->c_len == CBD_UNCOMPRESSED) ? lblk_per_pblk(&lbd->kparams->params) : DIV_ROUND_UP(lbd->c_len, pblk_size(&lbd->kparams->params)); + if (nr_pblk > lblk_per_pblk(&lbd->kparams->params)) { + printk(KERN_ERR "%s: elem len %u out of range at lblk=%lu\n", + __func__, lbd->c_len, (unsigned long)lbd->lblk); + ret = -EIO; + goto out; + } for (pblk_idx = 0, pg_idx = 0; pblk_idx < nr_pblk; ++pg_idx) { iov_len = min(nr_pblk - pblk_idx, pblk_per_page); for (n = 0; n < iov_len; ++n) {