|
| 1 | +From 409bfe7900dbc793448aab312aa540e97e8ba2e3 Mon Sep 17 00:00:00 2001 |
| 2 | +From: archana25-ms <v-shettigara@microsoft.com> |
| 3 | +Date: Tue, 11 Feb 2025 18:22:47 +0000 |
| 4 | +Subject: [PATCH] Address CVE-2023-28736 |
| 5 | + |
| 6 | +Source link: https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=ced5fa8b170ad448f4076e24a10c731b5cfb36ce |
| 7 | + |
| 8 | +--- |
| 9 | + mdadm.8.in | 5 +++++ |
| 10 | + mdadm.c | 9 ++++++++- |
| 11 | + mdadm.h | 5 +++++ |
| 12 | + 3 files changed, 18 insertions(+), 1 deletion(-) |
| 13 | + |
| 14 | +diff --git a/mdadm.8.in b/mdadm.8.in |
| 15 | +index 9aec9f4..58614fd 100644 |
| 16 | +--- a/mdadm.8.in |
| 17 | ++++ b/mdadm.8.in |
| 18 | +@@ -2129,6 +2129,11 @@ is run, but will be created by |
| 19 | + .I udev |
| 20 | + once the array becomes active. |
| 21 | + |
| 22 | ++The max length md-device name is limited to 32 characters. |
| 23 | ++Different metadata types have more strict limitation |
| 24 | ++(like IMSM where only 16 characters are allowed). |
| 25 | ++For that reason, long name could be truncated or rejected, it depends on metadata policy. |
| 26 | ++ |
| 27 | + As devices are added, they are checked to see if they contain RAID |
| 28 | + superblocks or filesystems. They are also checked to see if the variance in |
| 29 | + device size exceeds 1%. |
| 30 | +diff --git a/mdadm.c b/mdadm.c |
| 31 | +index 25a1abd..cb45b59 100644 |
| 32 | +--- a/mdadm.c |
| 33 | ++++ b/mdadm.c |
| 34 | +@@ -1354,9 +1354,16 @@ int main(int argc, char *argv[]) |
| 35 | + mdfd = open_mddev(devlist->devname, 1); |
| 36 | + if (mdfd < 0) |
| 37 | + exit(1); |
| 38 | +- } else |
| 39 | ++ } else { |
| 40 | ++ char *bname = basename(devlist->devname); |
| 41 | ++ |
| 42 | ++ if (strlen(bname) > MD_NAME_MAX) { |
| 43 | ++ pr_err("Name %s is too long.\n", devlist->devname); |
| 44 | ++ exit(1); |
| 45 | ++ } |
| 46 | + /* non-existent device is OK */ |
| 47 | + mdfd = open_mddev(devlist->devname, 0); |
| 48 | ++ } |
| 49 | + if (mdfd == -2) { |
| 50 | + pr_err("device %s exists but is not an md array.\n", devlist->devname); |
| 51 | + exit(1); |
| 52 | +diff --git a/mdadm.h b/mdadm.h |
| 53 | +index 387e681..e25d8a2 100644 |
| 54 | +--- a/mdadm.h |
| 55 | ++++ b/mdadm.h |
| 56 | +@@ -1793,3 +1793,8 @@ char *xstrdup(const char *str); |
| 57 | + #define INVALID_SECTORS 1 |
| 58 | + /* And another special number needed for --data_offset=variable */ |
| 59 | + #define VARIABLE_OFFSET 3 |
| 60 | ++ |
| 61 | ++/** |
| 62 | ++ * This is true for native and DDF, IMSM allows 16. |
| 63 | ++ */ |
| 64 | ++#define MD_NAME_MAX 32 |
| 65 | +-- |
| 66 | +2.45.2 |
| 67 | + |
0 commit comments