Linux Kernel dm-integrity: Infinite Loop DoS on Discard Operations

漏洞概述 该漏洞涉及Linux内核中的 模块，当处理带有丢弃（discard）操作的块设备时，存在一个无限循环的问题。具体来说，当 模块处理带有丢弃操作的块设备时，它会使用一个大小为 的缓冲区来覆盖顶部，从而阻止块设备在写入时覆盖数据。如果 设置为 ，则 模块会进入无限循环。 影响范围 受影响模块: 受影响版本: 未明确指定，但根据提交日期（2020-08-21），可以推测影响的是2020年8月之前的版本。 影响功能: 带有丢弃操作的块设备处理 修复方案 修复方案是通过使用 字段来限制 的最大大小。具体修改如下： ```c if (unlikely(discard_size == REQ_OP_DISCARD)) { unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter.bi_size); unsigned int max_size = likely(details->ic_iter

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel dm-integrity: Infinite Loop DoS on Discard Operations

More from this source