dm integrity: fix memory corruption when tag_size is less than digest size

[mirror_ubuntu-jammy-kernel.git] / drivers / md / dm-integrity.c

diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index dc03b70f6e65c59e52afe99341838189e10707a3..e2a51c184a2545c24c67d0488d975b0441a4ed94 100644 (file)
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -2459,9 +2459,11 @@ static void do_journal_write(struct dm_integrity_c *ic, unsigned write_start,
                                        dm_integrity_io_error(ic, "invalid sector in journal", -EIO);
                                        sec &= ~(sector_t)(ic->sectors_per_block - 1);
                                }
+                               if (unlikely(sec >= ic->provided_data_sectors)) {
+                                       journal_entry_set_unused(je);
+                                       continue;
+                               }
                        }
-                       if (unlikely(sec >= ic->provided_data_sectors))
-                               continue;
                        get_area_and_offset(ic, sec, &area, &offset);
                        restore_last_bytes(ic, access_journal_data(ic, i, j), je);
                        for (k = j + 1; k < ic->journal_section_entries; k++) {
@@ -4381,6 +4383,7 @@ try_smaller_buffer:
        }
 
        if (ic->internal_hash) {
+               size_t recalc_tags_size;
                ic->recalc_wq = alloc_workqueue("dm-integrity-recalc", WQ_MEM_RECLAIM, 1);
                if (!ic->recalc_wq ) {
                        ti->error = "Cannot allocate workqueue";
@@ -4394,8 +4397,10 @@ try_smaller_buffer:
                        r = -ENOMEM;
                        goto bad;
                }
-               ic->recalc_tags = kvmalloc_array(RECALC_SECTORS >> ic->sb->log2_sectors_per_block,
-                                                ic->tag_size, GFP_KERNEL);
+               recalc_tags_size = (RECALC_SECTORS >> ic->sb->log2_sectors_per_block) * ic->tag_size;
+               if (crypto_shash_digestsize(ic->internal_hash) > ic->tag_size)
+                       recalc_tags_size += crypto_shash_digestsize(ic->internal_hash) - ic->tag_size;
+               ic->recalc_tags = kvmalloc(recalc_tags_size, GFP_KERNEL);
                if (!ic->recalc_tags) {
                        ti->error = "Cannot allocate tags for recalculating";
                        r = -ENOMEM;