diff options
| author |   Jianyun Gao <jianyungao89@gmail.com> | 2026-07-20 17:46:48 +0800 |
|---|---|---|
| committer |   Mikulas Patocka <mpatocka@redhat.com> | 2026-07-20 15:35:35 +0200 |
| commit | fb9e17287a4ea1cbbcedc77e6866978ecc2a7b55 (patch) | |
| tree | 488105447cf0b5ec848f7961d4a0a5e185a9aeae | |
| parent | dm raid1: reserve space for NUL-terminator in build_constructor_string() (diff) | |
dm-pcache: fix implicit u8 truncation of gc_percent in message handler
When setting gc_percent via message, kstrtoul parses the input into an
unsigned long, which is then implicitly truncated to u8 when passed to
pcache_cache_set_gc_percent(). For example, value 266 (0x10A) silently
truncates to 10 (0x0A), successfully bypassing the > 90 upper bound
check in pcache_cache_set_gc_percent(), and setting a different value
than the user intended.
Use kstrtou8 directly instead of kstrtoul, so that overflow values are
properly rejected.
Cc: stable@vger.kernel.org
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
| -rw-r--r-- | drivers/md/dm-pcache/dm_pcache.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/md/dm-pcache/dm_pcache.c b/drivers/md/dm-pcache/dm_pcache.c index d5cfd162c063..645fc27d82ba 100644 --- a/drivers/md/dm-pcache/dm_pcache.c +++ b/drivers/md/dm-pcache/dm_pcache.c @@ -439,13 +439,13 @@ static int dm_pcache_message(struct dm_target *ti, unsigned int argc, char **argv, char *result, unsigned int maxlen) { struct dm_pcache *pcache = ti->private; - unsigned long val; + u8 val; if (argc != 2) goto err; if (!strcasecmp(argv[0], "gc_percent")) { - if (kstrtoul(argv[1], 10, &val)) + if (kstrtou8(argv[1], 10, &val)) goto err; return pcache_cache_set_gc_percent(&pcache->cache, val); |