Hi
Accepted into the dm-7.3 branch.
Mikulas
On Tue, 15 Sep 2026, Ben Cressey wrote:
> In inline mode, dm_integrity_check and dm_integrity_inline_recheck
> compute the checksum of each block into an on-stack buffer of
> HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result
> with zeroes up to the tag size, so if the tag size is larger than
> HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With
> CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the
> first read.
>
> Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5
> ("dm integrity: fix a crash with unusually large tag size") did for
> integrity_metadata.
>
> Fixes: fb0987682c62 ("dm-integrity: introduce the Inline mode")
> Cc: [email protected]
> Signed-off-by: Ben Cressey <[email protected]>
> Assisted-by: LLM
> ---
> To reproduce: QEMU nvme-ns with ms=128 and 4096-byte blocks, table
> "0 8192 integrity /dev/nvme0n1 0 100 I 3
> internal_hash:hmac(sha256):<key> fix_hmac block_size:4096", then read
> the device.
>
> For stable: before commit 5076d4599ce1 ("dm-integrity: enable
> asynchronous hash interface") in 6.18, the dm_integrity_check buffer
> was in dm_integrity_end_io.
> ---
> drivers/md/dm-integrity.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
> index 92970e12267ab..0862f31b8498d 100644
> --- a/drivers/md/dm-integrity.c
> +++ b/drivers/md/dm-integrity.c
> @@ -2721,7 +2721,7 @@ static void dm_integrity_inline_recheck(struct
> work_struct *w)
> outgoing_data = dio->integrity_payload + PAGE_SIZE;
>
> while (dio->bio_details.bi_iter.bi_size) {
> - char digest[HASH_MAX_DIGESTSIZE];
> + char digest[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
> int r;
> struct bio_integrity_payload *bip;
> struct bio_vec bv;
> @@ -2788,7 +2788,7 @@ static inline bool dm_integrity_check(struct
> dm_integrity_c *ic, struct dm_integ
> unsigned pos = 0;
>
> while (dio->bio_details.bi_iter.bi_size) {
> - char digest[HASH_MAX_DIGESTSIZE];
> + char digest[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
> struct bio_vec bv = bio_iter_iovec(bio,
> dio->bio_details.bi_iter);
> char *mem = integrity_kmap(ic, bv.bv_page);
> integrity_sector_checksum(ic, &dio->ahash_req,
> dio->bio_details.bi_iter.bi_sector, mem, bv.bv_offset, digest);
>
> ---
> base-commit: df2908090cda368b01ff43709f51890076c56157
> change-id: 20260915-dm-integrity-inline-tag-645e17849955
>
