提交 b468e000 编写于 作者: C Coly Li 提交者: Greg Kroah-Hartman

bcache: fix potential div-zero error of writeback_rate_i_term_inverse

[ Upstream commit c3b75a2199cdbfc1c335155fe143d842604b1baa ]

dc->writeback_rate_i_term_inverse can be set via sysfs interface. It is
in type unsigned int, and convert from input string by d_strtoul(). The
problem is d_strtoul() does not check valid range of the input, if
4294967296 is written into sysfs file writeback_rate_i_term_inverse,
an overflow of unsigned integer will happen and value 0 is set to
dc->writeback_rate_i_term_inverse.

In writeback.c:__update_writeback_rate(), there are following lines of
code,
      integral_scaled = div_s64(dc->writeback_rate_integral,
                      dc->writeback_rate_i_term_inverse);
If dc->writeback_rate_i_term_inverse is set to 0 via sysfs interface,
a div-zero error might be triggered in the above code.

Therefore we need to add a range limitation in the sysfs interface,
this is what this patch does, use sysfs_stroul_clamp() to replace
d_strtoul() and restrict the input range in [1, UINT_MAX].
Signed-off-by: NColy Li <colyli@suse.de>
Signed-off-by: NJens Axboe <axboe@kernel.dk>
Signed-off-by: NSasha Levin <sashal@kernel.org>
上级 c7b687eb
...@@ -283,7 +283,9 @@ STORE(__cached_dev) ...@@ -283,7 +283,9 @@ STORE(__cached_dev)
sysfs_strtoul_clamp(writeback_rate_update_seconds, sysfs_strtoul_clamp(writeback_rate_update_seconds,
dc->writeback_rate_update_seconds, dc->writeback_rate_update_seconds,
1, WRITEBACK_RATE_UPDATE_SECS_MAX); 1, WRITEBACK_RATE_UPDATE_SECS_MAX);
d_strtoul(writeback_rate_i_term_inverse); sysfs_strtoul_clamp(writeback_rate_i_term_inverse,
dc->writeback_rate_i_term_inverse,
1, UINT_MAX);
d_strtoul_nonzero(writeback_rate_p_term_inverse); d_strtoul_nonzero(writeback_rate_p_term_inverse);
d_strtoul_nonzero(writeback_rate_minimum); d_strtoul_nonzero(writeback_rate_minimum);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册