queue-4.19/bcache-fix-potential-div-zero-error-of-writeback_rat.patch

   1 From 5e94e9dd1b3ac8fd53821f7e23913f3d559652c3 Mon Sep 17 00:00:00 2001
   2 From: Coly Li <colyli@suse.de>
   3 Date: Sat, 9 Feb 2019 12:53:05 +0800
   4 Subject: bcache: fix potential div-zero error of writeback_rate_i_term_inverse
   5
   6 [ Upstream commit c3b75a2199cdbfc1c335155fe143d842604b1baa ]
   7
   8 dc->writeback_rate_i_term_inverse can be set via sysfs interface. It is
   9 in type unsigned int, and convert from input string by d_strtoul(). The
  10 problem is d_strtoul() does not check valid range of the input, if
  11 4294967296 is written into sysfs file writeback_rate_i_term_inverse,
  12 an overflow of unsigned integer will happen and value 0 is set to
  13 dc->writeback_rate_i_term_inverse.
  14
  15 In writeback.c:__update_writeback_rate(), there are following lines of
  16 code,
  17       integral_scaled = div_s64(dc->writeback_rate_integral,
  18                       dc->writeback_rate_i_term_inverse);
  19 If dc->writeback_rate_i_term_inverse is set to 0 via sysfs interface,
  20 a div-zero error might be triggered in the above code.
  21
  22 Therefore we need to add a range limitation in the sysfs interface,
  23 this is what this patch does, use sysfs_stroul_clamp() to replace
  24 d_strtoul() and restrict the input range in [1, UINT_MAX].
  25
  26 Signed-off-by: Coly Li <colyli@suse.de>
  27 Signed-off-by: Jens Axboe <axboe@kernel.dk>
  28 Signed-off-by: Sasha Levin <sashal@kernel.org>
  29 ---
  30  drivers/md/bcache/sysfs.c | 4 +++-
  31  1 file changed, 3 insertions(+), 1 deletion(-)
  32
  33 diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
  34 index 01c7c4452a26..503ad954ccc0 100644
  35 --- a/drivers/md/bcache/sysfs.c
  36 +++ b/drivers/md/bcache/sysfs.c
  37 @@ -283,7 +283,9 @@ STORE(__cached_dev)
  38         sysfs_strtoul_clamp(writeback_rate_update_seconds,
  39                             dc->writeback_rate_update_seconds,
  40                             1, WRITEBACK_RATE_UPDATE_SECS_MAX);
  41 -       d_strtoul(writeback_rate_i_term_inverse);
  42 +       sysfs_strtoul_clamp(writeback_rate_i_term_inverse,
  43 +                           dc->writeback_rate_i_term_inverse,
  44 +                           1, UINT_MAX);
  45         d_strtoul_nonzero(writeback_rate_p_term_inverse);
  46         d_strtoul_nonzero(writeback_rate_minimum);
  47
  48 --
  49 2.19.1
  50