From: Coly Li Date: Sat, 9 Feb 2019 04:53:09 +0000 (+0800) Subject: bcache: fix input overflow to cache set io_error_limit X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=b15008403b59955c9fa0c8b55cadd6dae991a4e9;p=openwrt%2Fstaging%2Fblogic.git bcache: fix input overflow to cache set io_error_limit c->error_limit is in type unsigned int, it is set via cache set sysfs file io_error_limit. Inside the bcache code, input string is converted by strtoul_or_return() and set the converted value to c->error_limit. Because the converted value is unsigned long, and c->error_limit is unsigned int, if the input is large enought, overflow will happen to c->error_limit. This patch uses sysfs_strtoul_clamp() to convert input string, and set the range in [0, UINT_MAX] to avoid the potential overflow. Signed-off-by: Coly Li Signed-off-by: Jens Axboe --- diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c index 201e85bbe3eb..467105614324 100644 --- a/drivers/md/bcache/sysfs.c +++ b/drivers/md/bcache/sysfs.c @@ -801,8 +801,7 @@ STORE(__bch_cache_set) c->on_error = v; } - if (attr == &sysfs_io_error_limit) - c->error_limit = strtoul_or_return(buf); + sysfs_strtoul_clamp(io_error_limit, c->error_limit, 0, UINT_MAX); /* See count_io_errors() for why 88 */ if (attr == &sysfs_io_error_halflife)