In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iomap: fix out-of-bounds bitmap_set() with zero-length range<\/p>\n
ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk
\nas (off + len – 1) >> i_blkbits. When off is 0 and len is 0, the
\nunsigned subtraction underflows to SIZE_MAX, producing a huge
\nlast_blk and nr_blks value that causes bitmap_set() to write far
\nbeyond the ifs->state allocation.<\/p>\n
Regarding ifs_set_range_uptodate(), it is temporarily safe because len
\ncannot be passed in as 0. However, for ifs_set_range_dirty() this is
\nreachable from __iomap_write_end(): when copy_folio_from_iter_atomic()
\nreturns 0 (e.g. user buffer fault) and the folio is already uptodate,
\nthe guard at the top of __iomap_write_end() does not trigger because
\n!folio_test_uptodate() is false, and iomap_set_range_dirty() is called
\nwith copied == 0.<\/p>\n
Add a !len guard to both functions before the computation, so that a
\nzero-length range is a no-op.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iomap: fix out-of-bounds bitmap_set() with zero-length range<\/p>\n
ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk
\na<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5352","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5352","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}