Re: [PATCH 7.2.y] dm-pcache: reject a kset that overruns its segment

[Greg KH <greg@kroah.com>]

On Wed, Sep 09, 2026 at 08:18:34PM -0400, Sasha Levin wrote:
> From: Bryam Vargas <hexlabsecurity@proton.me>
> 
> [ Upstream commit 7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb ]
> 
> cache_replay(), the writeback worker and the GC worker read a kset of
> get_kset_onmedia_size() bytes and advance the position by it. A forged
> key_num makes that size exceed the segment's remaining space, so the
> advance walks past the segment and trips the cache_pos_advance() BUG_ON.
> 
> Reject a kset whose on-media size exceeds cache_seg_remain() before use.
> 
> Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
> Cc: stable@vger.kernel.org
> Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> [ backported missing writeback_errors support from the upstream dependency. ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/md/dm-pcache/cache.h           | 1 +
>  drivers/md/dm-pcache/cache_gc.c        | 5 +++++
>  drivers/md/dm-pcache/cache_key.c       | 5 +++++
>  drivers/md/dm-pcache/cache_writeback.c | 8 ++++++++
>  4 files changed, 19 insertions(+)
> 
> diff --git a/drivers/md/dm-pcache/cache.h b/drivers/md/dm-pcache/cache.h
> index afc112b79496a..93c1e699a3944 100644
> --- a/drivers/md/dm-pcache/cache.h
> +++ b/drivers/md/dm-pcache/cache.h
> @@ -180,6 +180,7 @@ struct pcache_cache {
>  		u32 advance;
>  		int ret;
>  	} writeback_ctx;
> +	atomic_t		writeback_errors;
>  
>  	char gc_kset_onmedia_buf[PCACHE_KSET_ONMEDIA_SIZE_MAX];
>  	struct delayed_work	gc_work;
> diff --git a/drivers/md/dm-pcache/cache_gc.c b/drivers/md/dm-pcache/cache_gc.c
> index 3088cfef951bc..99999a92c4e67 100644
> --- a/drivers/md/dm-pcache/cache_gc.c
> +++ b/drivers/md/dm-pcache/cache_gc.c
> @@ -134,6 +134,11 @@ void pcache_cache_gc_fn(struct work_struct *work)
>  			continue;
>  		}
>  
> +		if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(&key_tail)) {
> +			atomic_inc(&cache->gc_errors);
> +			return;
> +		}
> +
>  		for (i = 0; i < kset_onmedia->key_num; i++) {
>  			struct pcache_cache_key key_tmp = { 0 };
>  
> diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
> index 51dd1ccf4e2fd..93933651d2c96 100644
> --- a/drivers/md/dm-pcache/cache_key.c
> +++ b/drivers/md/dm-pcache/cache_key.c
> @@ -811,6 +811,11 @@ int cache_replay(struct pcache_cache *cache)
>  		}
>  
>  		/* Replay the kset and check for errors. */
> +		if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(pos)) {
> +			ret = -EIO;
> +			goto out;
> +		}
> +
>  		ret = kset_replay(cache, kset_onmedia);
>  		if (ret)
>  			goto out;
> diff --git a/drivers/md/dm-pcache/cache_writeback.c b/drivers/md/dm-pcache/cache_writeback.c
> index 3df8687e2382f..656e4d0489121 100644
> --- a/drivers/md/dm-pcache/cache_writeback.c
> +++ b/drivers/md/dm-pcache/cache_writeback.c
> @@ -229,6 +229,9 @@ void cache_writeback_fn(struct work_struct *work)
>  	if (pcache_is_stopping(pcache))
>  		goto unlock;
>  
> +	if (atomic_read(&cache->writeback_errors))
> +		goto unlock;
> +
>  	kset_onmedia = (struct pcache_cache_kset_onmedia *)cache->wb_kset_onmedia_buf;
>  
>  	mutex_lock(&cache->dirty_tail_lock);
> @@ -246,6 +249,11 @@ void cache_writeback_fn(struct work_struct *work)
>  		goto queue_work;
>  	}
>  
> +	if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(&dirty_tail)) {
> +		atomic_inc(&cache->writeback_errors);
> +		goto unlock;
> +	}
> +
>  	ret = cache_kset_insert_tree(cache, kset_onmedia);
>  	if (ret) {
>  		delay = PCACHE_CACHE_WRITEBACK_INTERVAL;
> -- 
> 2.53.0
> 
> 

Does not apply :(