kernel/git/next/linux-next.git/drivers/md/dm-integrity.c, branch master

dm-integrity: replace forgeable discard filler with a keyed sector marker

2026-08-03T15:46:40+00:00

The discard-block check in dm_integrity_rw_tag() treats a stored tag of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded and skips HMAC verification. allow_discards is only accepted in dm-integrity's standalone mode. An attacker with raw write access to the backing device, but without the integrity key, can stamp any block with an all-0xf6 tag and have it served as authentic. Add a new "allow_discards_keyed" target argument that marks discarded blocks with a keyed checksum of (salt || sector) instead, computed by integrity_discard_checksum(). Fixes: 84597a44a9d8 ("dm integrity: add optional discard support") Co-developed-by: Jo Van Bulck Signed-off-by: Jo Van Bulck Signed-off-by: Shukai Ni Signed-off-by: Mikulas Patocka

dm-io: report non-retryable errors separatedly

2026-07-27T21:09:28+00:00

The error codes BLK_STS_NOTSUPP and BLK_STS_INVAL should not cause leg failure on dm-raid1. This patch changes the interface to dm-io, so that it reports two error bitmaps - error_bits and unsup_bits. The unsup_bit bitmap tracks BLK_STS_NOTSUPP or BLK_STS_INVAL errors, the error_bits bitmap tracks all the other errors. dm-raid1 is changed so that it won't fail a leg if it receives an error in the unsup_bits bitmap. This patch (with 62dc37a819a5) fixes misbehavior if the user uses unaligned bio vectors on dm-raid1. Fixes: 7eac33186957 ("iomap: simplify direct io validity check") Fixes: 5ff3f74e145a ("block: simplify direct io validity check") Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka

dm-integrity: fix wrong fallthrough in integrity_bio_wait

2026-07-13T19:32:24+00:00

If dm_integrity_map_inline returned DM_MAPIO_KILL, the code would set status BLK_STS_IOERR and then incorrectly fall through and submit the bio. Luckily, dm_integrity_map_inline can't return DM_MAPIO_KILL at this point, so the bug is just theoretical. Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-4.6

dm-integrity: clean-up error handling

2026-07-13T19:32:03+00:00

Add "goto bad" to error handling. This commit doesn't fix any bug, just cleans up the code. Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-4.6

dm-integrity: fix error message

2026-07-13T19:31:27+00:00

Change "reading tags" to "writing tags" because the error is reported when writing fails. Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-4.6

dm-integrity: fix a bug if the bio is out of limits

2026-07-10T12:39:47+00:00

If dm_integrity_check_limits fails, the code would exit with DM_MAPIO_KILL. However, the range would be already locked at this point, and it wouldn't be unlocked, resulting in a deadlock. Let's move the limit check up, so that when it exits, no resources are leaked. Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-4.6 Fixes: fb0987682c62 ("dm-integrity: introduce the Inline mode") Cc: stable@vger.kernel.org

dm-integrity: don't increment hash_offset twice

2026-07-10T12:39:16+00:00

hash_offset is already incremented in the loop "for (i = 0; i < to_copy; i++, ts--)". Do not increment it again. Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-4.6 Fixes: 84597a44a9d8 ("dm-integrity: dm integrity: add optional discard support") Cc: stable@vger.kernel.org

dm-integrity: fix leaking uninitialized kernel memory

2026-07-10T12:38:50+00:00

If hash size is less than device's tuple size, dm-integrity is supposed to zero the remaining space. There was a bug in the code that zeroing didn't work. This commit fixes it. Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-4.6 Fixes: fb0987682c62 ("dm-integrity: introduce the Inline mode") Cc: stable@vger.kernel.org

dm-integrity: fix the 'fix_hmac' option

2026-07-10T12:38:01+00:00

When the "fix_hmac" argument is used, dm-integrity is supposed to check the superblock with the journal_mac. However, there was a logic bug in the code - the code only checked the superblock mac if the bit SB_FLAG_FIXED_HMAC was set in the superblock. So, the attacker could clear this bit and bypass the checking trivially. This commit changes dm-integrity so that when the user specified the "fix_hmac" flag and the superblock doesn't have the bit SB_FLAG_FIXED_HMAC set, the activation is aborted with an error. Unfortunatelly, there's a bug in the integritysetup tool that when using the 'open' command it passes the "fix_hmac" argument to the kernel even if the user specified --integrity-legacy-hmac. The bug will be fixed in the upcoming 2.8.7 release. Signed-off-by: Mikulas Patocka Reported-by: Shukai Ni

dm: provide helper to set stacked limits

2026-03-27T21:19:17+00:00

There are multiple device mappers that set up their stacking limits exactly the same for the logical, physical and minimum IO queue limits. Provide a helper for it. Signed-off-by: Keith Busch Signed-off-by: Mikulas Patocka