| From ddf36f1532d71eb39fc59cd4656201ba55061bdf Mon Sep 17 00:00:00 2001 |
| From: Coly Li <colyli@suse.de> |
| Date: Thu, 20 Dec 2018 21:30:56 +0800 |
| Subject: [PATCH 09/11] bcache: fix input overflow to journal_delay_ms |
| |
| c->journal_delay_ms is in type unsigned short, it is set via sysfs |
| interface and converted by sysfs_strtoul() from input string to |
| unsigned short value. Therefore overflow to unsigned short might be |
| happen when the converted value exceed USHRT_MAX. e.g. writing |
| 65536 into sysfs file journal_delay_ms, c->journal_delay_ms is set to |
| 0. |
| |
| This patch uses sysfs_strtoul_clamp() to convert the input string and |
| limit value range in [0, USHRT_MAX], to avoid the input overflow. |
| |
| Signed-off-by: Coly Li <colyli@suse.de> |
| --- |
| drivers/md/bcache/sysfs.c | 4 +++- |
| 1 file changed, 3 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c |
| index aacb0e2fc81c..db12d4210a20 100644 |
| --- a/drivers/md/bcache/sysfs.c |
| +++ b/drivers/md/bcache/sysfs.c |
| @@ -809,7 +809,9 @@ STORE(__bch_cache_set) |
| } |
| } |
| |
| - sysfs_strtoul(journal_delay_ms, c->journal_delay_ms); |
| + sysfs_strtoul_clamp(journal_delay_ms, |
| + c->journal_delay_ms, |
| + 0, USHRT_MAX); |
| sysfs_strtoul_bool(verify, c->verify); |
| sysfs_strtoul_bool(key_merging_disabled,c->key_merging_disabled); |
| sysfs_strtoul(expensive_debug_checks, c->expensive_debug_checks); |
| -- |
| 2.16.4 |
| |