diff options
| author | Coly Li <colyli@suse.de> | 2019-02-09 12:53:05 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-04-05 22:34:40 +0200 |
| commit | 5db086d7c05f3e0b35d1cec0aab9f003f261cc5e (patch) | |
| tree | f72dd8a073cdd9bf0da00e8c2081f2da4db5702b | |
| parent | d4db0c5ee0b4c21c36b3556a20e44d5e1a372e2b (diff) | |
| download | talos-obmc-linux-5db086d7c05f3e0b35d1cec0aab9f003f261cc5e.tar.gz talos-obmc-linux-5db086d7c05f3e0b35d1cec0aab9f003f261cc5e.zip | |
bcache: fix potential div-zero error of writeback_rate_i_term_inverse
[ Upstream commit c3b75a2199cdbfc1c335155fe143d842604b1baa ]
dc->writeback_rate_i_term_inverse can be set via sysfs interface. It is
in type unsigned int, and convert from input string by d_strtoul(). The
problem is d_strtoul() does not check valid range of the input, if
4294967296 is written into sysfs file writeback_rate_i_term_inverse,
an overflow of unsigned integer will happen and value 0 is set to
dc->writeback_rate_i_term_inverse.
In writeback.c:__update_writeback_rate(), there are following lines of
code,
integral_scaled = div_s64(dc->writeback_rate_integral,
dc->writeback_rate_i_term_inverse);
If dc->writeback_rate_i_term_inverse is set to 0 via sysfs interface,
a div-zero error might be triggered in the above code.
Therefore we need to add a range limitation in the sysfs interface,
this is what this patch does, use sysfs_stroul_clamp() to replace
d_strtoul() and restrict the input range in [1, UINT_MAX].
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/md/bcache/sysfs.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c index f98cda32065d..28e0d5a5e25b 100644 --- a/drivers/md/bcache/sysfs.c +++ b/drivers/md/bcache/sysfs.c @@ -287,7 +287,9 @@ STORE(__cached_dev) sysfs_strtoul_clamp(writeback_rate_update_seconds, dc->writeback_rate_update_seconds, 1, WRITEBACK_RATE_UPDATE_SECS_MAX); - d_strtoul(writeback_rate_i_term_inverse); + sysfs_strtoul_clamp(writeback_rate_i_term_inverse, + dc->writeback_rate_i_term_inverse, + 1, UINT_MAX); d_strtoul_nonzero(writeback_rate_p_term_inverse); d_strtoul_nonzero(writeback_rate_minimum); |
