lkml.org 
[lkml]   [2019]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.0 162/262] bcache: fix potential div-zero error of writeback_rate_i_term_inverse
    Date
    From: Coly Li <colyli@suse.de>

    [ Upstream commit c3b75a2199cdbfc1c335155fe143d842604b1baa ]

    dc->writeback_rate_i_term_inverse can be set via sysfs interface. It is
    in type unsigned int, and convert from input string by d_strtoul(). The
    problem is d_strtoul() does not check valid range of the input, if
    4294967296 is written into sysfs file writeback_rate_i_term_inverse,
    an overflow of unsigned integer will happen and value 0 is set to
    dc->writeback_rate_i_term_inverse.

    In writeback.c:__update_writeback_rate(), there are following lines of
    code,
    integral_scaled = div_s64(dc->writeback_rate_integral,
    dc->writeback_rate_i_term_inverse);
    If dc->writeback_rate_i_term_inverse is set to 0 via sysfs interface,
    a div-zero error might be triggered in the above code.

    Therefore we need to add a range limitation in the sysfs interface,
    this is what this patch does, use sysfs_stroul_clamp() to replace
    d_strtoul() and restrict the input range in [1, UINT_MAX].

    Signed-off-by: Coly Li <colyli@suse.de>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/md/bcache/sysfs.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
    index f98cda32065d..28e0d5a5e25b 100644
    --- a/drivers/md/bcache/sysfs.c
    +++ b/drivers/md/bcache/sysfs.c
    @@ -287,7 +287,9 @@ STORE(__cached_dev)
    sysfs_strtoul_clamp(writeback_rate_update_seconds,
    dc->writeback_rate_update_seconds,
    1, WRITEBACK_RATE_UPDATE_SECS_MAX);
    - d_strtoul(writeback_rate_i_term_inverse);
    + sysfs_strtoul_clamp(writeback_rate_i_term_inverse,
    + dc->writeback_rate_i_term_inverse,
    + 1, UINT_MAX);
    d_strtoul_nonzero(writeback_rate_p_term_inverse);
    d_strtoul_nonzero(writeback_rate_minimum);

    --
    2.19.1
    \
     
     \ /
      Last update: 2019-03-27 20:40    [W:4.353 / U:1.360 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site