[PATCH] dm-integrity: fix buffer overflow in inline mode with large tag size

[Ben Cressey]

In inline mode, dm_integrity_check and dm_integrity_inline_recheck
compute the checksum of each block into an on-stack buffer of
HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result
with zeroes up to the tag size, so if the tag size is larger than
HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With
CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the
first read.

Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5
("dm integrity: fix a crash with unusually large tag size") did for
integrity_metadata.

Fixes: fb0987682c62 ("dm-integrity: introduce the Inline mode")
Cc: sta...@vger.kernel.org
Signed-off-by: Ben Cressey <b...@cressey.dev>
Assisted-by: LLM
---
To reproduce: QEMU nvme-ns with ms=128 and 4096-byte blocks, table
"0 8192 integrity /dev/nvme0n1 0 100 I 3
internal_hash:hmac(sha256):<key> fix_hmac block_size:4096", then read
the device.

For stable: before commit 5076d4599ce1 ("dm-integrity: enable
asynchronous hash interface") in 6.18, the dm_integrity_check buffer
was in dm_integrity_end_io.
---
 drivers/md/dm-integrity.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 92970e12267ab..0862f31b8498d 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -2721,7 +2721,7 @@ static void dm_integrity_inline_recheck(struct 
work_struct *w)
        outgoing_data = dio->integrity_payload + PAGE_SIZE;
 
        while (dio->bio_details.bi_iter.bi_size) {
-               char digest[HASH_MAX_DIGESTSIZE];
+               char digest[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
                int r;
                struct bio_integrity_payload *bip;
                struct bio_vec bv;
@@ -2788,7 +2788,7 @@ static inline bool dm_integrity_check(struct 
dm_integrity_c *ic, struct dm_integ
        unsigned pos = 0;
 
        while (dio->bio_details.bi_iter.bi_size) {
-               char digest[HASH_MAX_DIGESTSIZE];
+               char digest[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
                struct bio_vec bv = bio_iter_iovec(bio, 
dio->bio_details.bi_iter);
                char *mem = integrity_kmap(ic, bv.bv_page);
                integrity_sector_checksum(ic, &dio->ahash_req, 
dio->bio_details.bi_iter.bi_sector, mem, bv.bv_offset, digest);

---
base-commit: df2908090cda368b01ff43709f51890076c56157
change-id: 20260915-dm-integrity-inline-tag-645e17849955