[PATCH] dm-integrity: fix buffer overflow in inline mode with large tag size

[PATCH] dm-integrity: fix buffer overflow in inline mode with large tag size

[Ben Cressey]

In inline mode, dm_integrity_check and dm_integrity_inline_recheck
compute the checksum of each block into an on-stack buffer of
HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result
with zeroes up to the tag size, so if the tag size is larger than
HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With
CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the
first read.

Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5
("dm integrity: fix a crash with unusually large tag size") did for
integrity_metadata.

Fixes: fb0987682c62 ("dm-integrity: introduce the Inline mode")
Cc: stable@vger.kernel.org
Signed-off-by: Ben Cressey <ben@cressey.dev>
Assisted-by: LLM
---
To reproduce: QEMU nvme-ns with ms=128 and 4096-byte blocks, table
"0 8192 integrity /dev/nvme0n1 0 100 I 3
internal_hash:hmac(sha256):<key> fix_hmac block_size:4096", then read
the device.

For stable: before commit 5076d4599ce1 ("dm-integrity: enable
asynchronous hash interface") in 6.18, the dm_integrity_check buffer
was in dm_integrity_end_io.
---
 drivers/md/dm-integrity.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 92970e12267ab..0862f31b8498d 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -2721,7 +2721,7 @@ static void dm_integrity_inline_recheck(struct work_struct *w)
 	outgoing_data = dio->integrity_payload + PAGE_SIZE;
 
 	while (dio->bio_details.bi_iter.bi_size) {
-		char digest[HASH_MAX_DIGESTSIZE];
+		char digest[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
 		int r;
 		struct bio_integrity_payload *bip;
 		struct bio_vec bv;
@@ -2788,7 +2788,7 @@ static inline bool dm_integrity_check(struct dm_integrity_c *ic, struct dm_integ
 	unsigned pos = 0;
 
 	while (dio->bio_details.bi_iter.bi_size) {
-		char digest[HASH_MAX_DIGESTSIZE];
+		char digest[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
 		struct bio_vec bv = bio_iter_iovec(bio, dio->bio_details.bi_iter);
 		char *mem = integrity_kmap(ic, bv.bv_page);
 		integrity_sector_checksum(ic, &dio->ahash_req, dio->bio_details.bi_iter.bi_sector, mem, bv.bv_offset, digest);

---
base-commit: df2908090cda368b01ff43709f51890076c56157
change-id: 20260915-dm-integrity-inline-tag-645e17849955

Re: [PATCH] dm-integrity: fix buffer overflow in inline mode with large tag size

[Mikulas Patocka]

Hi

Accepted into the dm-7.3 branch.

Mikulas


On Tue, 15 Sep 2026, Ben Cressey wrote:

> In inline mode, dm_integrity_check and dm_integrity_inline_recheck
> compute the checksum of each block into an on-stack buffer of
> HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result
> with zeroes up to the tag size, so if the tag size is larger than
> HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With
> CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the
> first read.
> 
> Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5
> ("dm integrity: fix a crash with unusually large tag size") did for
> integrity_metadata.
> 
> Fixes: fb0987682c62 ("dm-integrity: introduce the Inline mode")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ben Cressey <ben@cressey.dev>
> Assisted-by: LLM
> ---
> To reproduce: QEMU nvme-ns with ms=128 and 4096-byte blocks, table
> "0 8192 integrity /dev/nvme0n1 0 100 I 3
> internal_hash:hmac(sha256):<key> fix_hmac block_size:4096", then read
> the device.
> 
> For stable: before commit 5076d4599ce1 ("dm-integrity: enable
> asynchronous hash interface") in 6.18, the dm_integrity_check buffer
> was in dm_integrity_end_io.
> ---
>  drivers/md/dm-integrity.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
> index 92970e12267ab..0862f31b8498d 100644
> --- a/drivers/md/dm-integrity.c
> +++ b/drivers/md/dm-integrity.c
> @@ -2721,7 +2721,7 @@ static void dm_integrity_inline_recheck(struct work_struct *w)
>  	outgoing_data = dio->integrity_payload + PAGE_SIZE;
>  
>  	while (dio->bio_details.bi_iter.bi_size) {
> -		char digest[HASH_MAX_DIGESTSIZE];
> +		char digest[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
>  		int r;
>  		struct bio_integrity_payload *bip;
>  		struct bio_vec bv;
> @@ -2788,7 +2788,7 @@ static inline bool dm_integrity_check(struct dm_integrity_c *ic, struct dm_integ
>  	unsigned pos = 0;
>  
>  	while (dio->bio_details.bi_iter.bi_size) {
> -		char digest[HASH_MAX_DIGESTSIZE];
> +		char digest[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
>  		struct bio_vec bv = bio_iter_iovec(bio, dio->bio_details.bi_iter);
>  		char *mem = integrity_kmap(ic, bv.bv_page);
>  		integrity_sector_checksum(ic, &dio->ahash_req, dio->bio_details.bi_iter.bi_sector, mem, bv.bv_offset, digest);
> 
> ---
> base-commit: df2908090cda368b01ff43709f51890076c56157
> change-id: 20260915-dm-integrity-inline-tag-645e17849955
>