[PATCH 0/2] dm-integrity: two fixes for the discard path in integrity_metadata
From: Ben Cressey
Date: Thu Aug 20 2026 - 17:46:43 EST
Two small fixes for the REQ_OP_DISCARD branch of integrity_metadata().
The first one fixes an out-of-bounds write introduced by the keyed
discard marker patch merged for 7.3: when the tag is smaller than the
digest, the checksum of the last block in each batch is written past the
end of the buffer. The second one fixes a much older endless loop on the
kmalloc-failure fallback with tags larger than 64 bytes.
1/2 is ordered first because 2/2 on its own would move the 1/2
overflow from the kmalloc'ed page onto the stack.
---
Ben Cressey (2):
dm-integrity: fix buffer overflow with keyed discard
dm-integrity: fix infinite loop on discard with large tag size
drivers/md/dm-integrity.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
---
base-commit: 39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713
change-id: 20260820-dm-integrity-discard-9480ad85f58f