kernel/git/next/linux-next.git/drivers/md/dm-ioctl.c, branch master

dm: lookup_ioctl(): Use designated array initialers

2026-07-16T14:00:51+00:00

Use designated initialisers for the _ioctls[] array and delete the unused field that contained the array index. Makes the code more robust against the order of the initialers. Any uninitialised entries would be processed corretly. Signed-off-by: David Laight Signed-off-by: Mikulas Patocka

dm: list_devices(): Only process devices once

2026-07-16T14:00:41+00:00

Instead of doing a prescan to determine the length of buffer required, checking the supplied buffer is big enough, and then doing a second scan to fill the output buffer just do a single scan and detect when the buffer is too short. For additional safety only call strlen() once and use the returned length for everything (incuding the copy). Ensure than all the pad bytes between the entries are zero. Signed-off-by: David Laight Signed-off-by: Mikulas Patocka

dm: __list_versions(): Only process targets once

2026-07-16T14:00:31+00:00

Instead of doing a prescan to determine the length of buffer required, checking the supplied buffer is big enough, and then doing a second scan to fill the output buffer just do a single scan and detect when the buffer is too short. This removes any problems that might occur if a 'target' is added between the scans. For additional safety only call strlen(tt->name) once and use the returned length for everything (incuding the copy). Ensure than all the pad bytes between the entries are zero. Set param->data_size to the actual size of the data. It was slightly large because ALIGN_MASK was added in instead of the size being rounded up. Signed-off-by: David Laight Signed-off-by: Mikulas Patocka

dm: drop redundant nonseekable_open() return check

2026-07-15T13:55:25+00:00

nonseekable_open() never fails, so the error check is unnecessary. Remove the dead error handling path. Signed-off-by: Bui Duc Phuc Signed-off-by: Mikulas Patocka

dm-ioctl: delete a useless condition

2026-07-13T19:32:48+00:00

The condition "remaining <= 0" can never be true. The variable remaining has type size_t, thus it can't be negative. It can't be zero because we made sure earlier that "remaining > sizeof(struct dm_target_spec)" and then we added "sizeof(struct dm_target_spec)" to "outptr" (this means that we subtraceted "sizeof(struct dm_target_spec)" from "remaining"). Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-4.6

dm-ioctl: fix a possible overflow in list_version_get_info

2026-07-10T12:40:51+00:00

sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the output buffer - info->vers->version[0], info->vers->version[1], info->vers->version[2] and info->vers->next. This can cause buffer overflow. Fix this buffer overflow by replacing "sizeof(tt->version)" with "sizeof(struct dm_target_versions)". Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-4.6 Cc: stable@vger.kernel.org

dm_early_create: fix freeing used table on dm_resume failure

2026-07-10T12:40:24+00:00

If dm_resume fails, the kernel attempts to free table with dm_table_destroy, but the table was already instantiated with dm_swap_table. This commit skips the call to dm_table_destroy in this case. Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-4.6 Fixes: 6bbc923dfcf5 ("dm: add support to directly boot to a mapped device") Cc: stable@vger.kernel.org

dm-ioctl: report an error if a device has no table

2026-05-18T12:27:11+00:00

When we send a message to a device that has no table, the return code was not set. The code would return "2", which is not considered a valid return value. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Reviewed-by: Benjamin Marzinski

dm-ima: remove new_map from dm_ima_measure_on_device_clear

2026-05-04T12:53:19+00:00

Now that two processes can't modify md->ima in dm_ima_measure_on_device_clear() at the same time, there's no need to track if an inactive table was actually removed. We might as well clean it up unconditionally, on the off chance that a previous ima measurement failed and left md->ima.inactive_table behind. Signed-off-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka

dm-ima: Fix UAF errors and measuring incorrect context

2026-05-04T12:53:09+00:00

the dm-ima code did not keep the dm_ima_measure_on_* functions from running at the same time. This could lead to various errors. If two processes were updating the device state, one could update the state first, but the other could measure the state first, causing the the current device state to appear incorrect. If a table load happened while a device was resuming, the IMA measurement could report the wrong table being active. And if two dm_ima_measure_on_* functions ran at the same time, one of them could free data that the other was accessing, causing a crash. All the core dm functions that call a dm_ima_measure_on_* function update the device state they want to measure under the _hash_lock, except for do_resume(). But holding the _hash_lock is not a good way to synchronize these functions. It's a global mutex, that is needed in many dm operations, and the dm_ima_measure_* functions can sleep, blocking any dm operation on any device that needs the _hash_lock. To serialize and order the IMA measurement functions, the dm_ima_measurements now has two counters, update_idx and measure_idx. update_idx is incremented while holding the _hash_lock and saved, along with the device name and uuid, in a dm_ima_context struct. Once the _hash_lock is dropped, the dm_ima_measure_* function is called. It waits until measure_idx matches the saved value of update_idx, ensuring that the updates and measurements happen in the same order if there are multiple processes changing the device at the same time. Then it measures the device, updates measure_idx, and wakes up any other process waiting to do a measurement. This makes sure that the measurements are serialized and done in the order that the _hash_lock was acquired in. But they only block other measurements for the same device, which are unlikely to happen at the same time. do_resume() is trickier, because it removes the inactive table while holding the _hash_lock, but doesn't hold it while updating md->map. To make sure it is also ordered, the IMA code grabs the _hash_lock after md->map is updated. Then it makes sure that the device isn't being removed and that another do_resume() hasn't already changed the active table again, and serializes like the other functions do. Signed-off-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka