github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 22:14:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

dm-pcache: bound the logical key offset from persistent memory

Browse Source 
cache_key_decode() takes a key's logical off from the cache device and
later indexes req_key_tree->subtrees[] by it in get_subtree(). An off
past the device forms a subtree pointer outside the array, which
rb_insert() writes through during replay.

Reject a key of zero length, or whose off+len (computed in 64 bits)
exceeds the device size, before it is used.

Fixes: 1d57628ff9 ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
This commit is contained in:
Bryam Vargas 2026-07-17 06:27:00 -05:00 committed by Mikulas Patocka
parent 16c3b3a326
commit 97fc4b53db
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/md/dm-pcache/cache_key.c
View File

@ -90,10 +90,19 @@ int cache_key_decode(struct pcache_cache *cache,
struct pcache_cache_key *key)
{
struct dm_pcache *pcache = CACHE_TO_PCACHE(cache);
u64 dev_bytes = (u64)cache->dev_size << SECTOR_SHIFT;
key->off = key_onmedia->off;
key->len = key_onmedia->len;
if (key_onmedia->len == 0 ||
key_onmedia->len > dev_bytes ||
key_onmedia->off > dev_bytes - key_onmedia->len) {
pcache_dev_err(pcache, "key off %llu + len %u exceeds device size\n",
key_onmedia->off, key_onmedia->len);
return -EIO;
}
if (!cache_seg_id_valid(cache, key_onmedia->cache_seg_id)) {
pcache_dev_err(pcache, "invalid cache_seg_id %u in cache key (n_segs %u)\n",
key_onmedia->cache_seg_id, cache->n_segs);