diff options
| author | Jianyun Gao <jianyungao89@gmail.com> | 2026-07-20 17:46:48 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-07 17:22:57 +0200 |
| commit | 10acf740c3adbbd86731b24d0bc43ec1010084bc (patch) | |
| tree | cf6bf36f658d798d9f59bd02d5a54e5a5db9ccf9 | |
| parent | 83e3116283ed2c6a6a1fa662862a4b4d7d2701a2 (diff) | |
| download | linux-10acf740c3adbbd86731b24d0bc43ec1010084bc.tar.gz linux-10acf740c3adbbd86731b24d0bc43ec1010084bc.zip | |
dm-pcache: fix implicit u8 truncation of gc_percent in message handler
commit fb9e17287a4ea1cbbcedc77e6866978ecc2a7b55 upstream.
When setting gc_percent via message, kstrtoul parses the input into an
unsigned long, which is then implicitly truncated to u8 when passed to
pcache_cache_set_gc_percent(). For example, value 266 (0x10A) silently
truncates to 10 (0x0A), successfully bypassing the > 90 upper bound
check in pcache_cache_set_gc_percent(), and setting a different value
than the user intended.
Use kstrtou8 directly instead of kstrtoul, so that overflow values are
properly rejected.
Cc: stable@vger.kernel.org
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/md/dm-pcache/dm_pcache.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/md/dm-pcache/dm_pcache.c b/drivers/md/dm-pcache/dm_pcache.c index 87bcc1c515a6..f6da50b57c67 100644 --- a/drivers/md/dm-pcache/dm_pcache.c +++ b/drivers/md/dm-pcache/dm_pcache.c @@ -439,13 +439,13 @@ static int dm_pcache_message(struct dm_target *ti, unsigned int argc, char **argv, char *result, unsigned int maxlen) { struct dm_pcache *pcache = ti->private; - unsigned long val; + u8 val; if (argc != 2) goto err; if (!strcasecmp(argv[0], "gc_percent")) { - if (kstrtoul(argv[1], 10, &val)) + if (kstrtou8(argv[1], 10, &val)) goto err; return pcache_cache_set_gc_percent(&pcache->cache, val); |