Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]dm raid: fix address sanitizer warning in raid_status[EOL][EOL]There is this warning when using a kernel with the address sanitizer[EOL]and running this testsuite:[EOL]https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid[EOL][EOL]==================================================================[EOL]BUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid][EOL]Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319[EOL]CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1[EOL]Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011[EOL]Call Trace:[EOL] <TASK>[EOL] dump_stack_lvl+0x6a/0x9c[EOL] print_address_description.constprop.0+0x1f/0x1e0[EOL] print_report.cold+0x55/0x244[EOL] kasan_report+0xc9/0x100[EOL] raid_status+0x1747/0x2820 [dm_raid][EOL] dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod][EOL] table_load+0x35c/0x630 [dm_mod][EOL] ctl_ioctl+0x411/0x630 [dm_mod][EOL] dm_ctl_ioctl+0xa/0x10 [dm_mod][EOL] __x64_sys_ioctl+0x12a/0x1a0[EOL] do_syscall_64+0x5b/0x80[EOL][EOL]The warning is caused by reading conf->max_nr_stripes in raid_status. The[EOL]code in raid_status reads mddev->private, casts it to struct r5conf and[EOL]reads the entry max_nr_stripes.[EOL][EOL]However, if we have different raid type than 4/5/6, mddev->private[EOL]doesn't point to struct r5conf; it may point to struct r0conf, struct[EOL]r1conf, struct r10conf or struct mpconf. If we cast a pointer to one[EOL]of these structs to struct r5conf, we will be reading invalid memory[EOL]and KASAN warns about it.[EOL][EOL]Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6.

CREATE(Triage):(User=lchen-cn) [CVE-2022-50084 (https://nvd.nist.gov/vuln/detail/CVE-2022-50084)