FAILED: patch "[PATCH] dm-pcache: bound the logical key offset from persistent" failed to apply to 7.2-stable tree

FAILED: patch "[PATCH] dm-pcache: bound the logical key offset from persistent" failed to apply to 7.2-stable tree

[gregkh]

The patch below does not apply to the 7.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-7.2.y
git checkout FETCH_HEAD
git cherry-pick -x 97fc4b53dbe4a983fdf093243067fa6a64562307
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026090433-ebony-snore-69ef@gregkh' --subject-prefix 'PATCH 7.2.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 97fc4b53dbe4a983fdf093243067fa6a64562307 Mon Sep 17 00:00:00 2001
From: Bryam Vargas <hexlabsecurity@proton.me>
Date: Fri, 17 Jul 2026 06:27:00 -0500
Subject: [PATCH] dm-pcache: bound the logical key offset from persistent
 memory

cache_key_decode() takes a key's logical off from the cache device and
later indexes req_key_tree->subtrees[] by it in get_subtree(). An off
past the device forms a subtree pointer outside the array, which
rb_insert() writes through during replay.

Reject a key of zero length, or whose off+len (computed in 64 bits)
exceeds the device size, before it is used.

Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
index 2284dbc0807b..86cc9565ffc7 100644
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -90,10 +90,19 @@ int cache_key_decode(struct pcache_cache *cache,
 			struct pcache_cache_key *key)
 {
 	struct dm_pcache *pcache = CACHE_TO_PCACHE(cache);
+	u64 dev_bytes = (u64)cache->dev_size << SECTOR_SHIFT;
 
 	key->off = key_onmedia->off;
 	key->len = key_onmedia->len;
 
+	if (key_onmedia->len == 0 ||
+	    key_onmedia->len > dev_bytes ||
+	    key_onmedia->off > dev_bytes - key_onmedia->len) {
+		pcache_dev_err(pcache, "key off %llu + len %u exceeds device size\n",
+				key_onmedia->off, key_onmedia->len);
+		return -EIO;
+	}
+
 	if (!cache_seg_id_valid(cache, key_onmedia->cache_seg_id)) {
 		pcache_dev_err(pcache, "invalid cache_seg_id %u in cache key (n_segs %u)\n",
 				key_onmedia->cache_seg_id, cache->n_segs);

[PATCH 7.2.y] dm-pcache: bound the logical key offset from persistent memory

[Sasha Levin]

From: Bryam Vargas <hexlabsecurity@proton.me>

[ Upstream commit 97fc4b53dbe4a983fdf093243067fa6a64562307 ]

cache_key_decode() takes a key's logical off from the cache device and
later indexes req_key_tree->subtrees[] by it in get_subtree(). An off
past the device forms a subtree pointer outside the array, which
rb_insert() writes through during replay.

Reject a key of zero length, or whose off+len (computed in 64 bits)
exceeds the device size, before it is used.

Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
[ adjusted context to account for the missing cache_seg_id_valid() check. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-pcache/cache_key.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
index 51dd1ccf4e2fd..c98005d16fd6b 100644
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -90,10 +90,19 @@ int cache_key_decode(struct pcache_cache *cache,
 			struct pcache_cache_key *key)
 {
 	struct dm_pcache *pcache = CACHE_TO_PCACHE(cache);
+	u64 dev_bytes = (u64)cache->dev_size << SECTOR_SHIFT;
 
 	key->off = key_onmedia->off;
 	key->len = key_onmedia->len;
 
+	if (key_onmedia->len == 0 ||
+	    key_onmedia->len > dev_bytes ||
+	    key_onmedia->off > dev_bytes - key_onmedia->len) {
+		pcache_dev_err(pcache, "key off %llu + len %u exceeds device size\n",
+				key_onmedia->off, key_onmedia->len);
+		return -EIO;
+	}
+
 	key->cache_pos.cache_seg = &cache->segments[key_onmedia->cache_seg_id];
 	key->cache_pos.seg_off = key_onmedia->cache_seg_off;
 
-- 
2.53.0

Re: [PATCH 7.2.y] dm-pcache: bound the logical key offset from persistent memory

[Greg KH]

On Wed, Sep 09, 2026 at 08:18:29PM -0400, Sasha Levin wrote:
> From: Bryam Vargas <hexlabsecurity@proton.me>
> 
> [ Upstream commit 97fc4b53dbe4a983fdf093243067fa6a64562307 ]
> 
> cache_key_decode() takes a key's logical off from the cache device and
> later indexes req_key_tree->subtrees[] by it in get_subtree(). An off
> past the device forms a subtree pointer outside the array, which
> rb_insert() writes through during replay.
> 
> Reject a key of zero length, or whose off+len (computed in 64 bits)
> exceeds the device size, before it is used.
> 
> Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
> Cc: stable@vger.kernel.org
> Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> [ adjusted context to account for the missing cache_seg_id_valid() check. ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/md/dm-pcache/cache_key.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
> index 51dd1ccf4e2fd..c98005d16fd6b 100644
> --- a/drivers/md/dm-pcache/cache_key.c
> +++ b/drivers/md/dm-pcache/cache_key.c
> @@ -90,10 +90,19 @@ int cache_key_decode(struct pcache_cache *cache,
>  			struct pcache_cache_key *key)
>  {
>  	struct dm_pcache *pcache = CACHE_TO_PCACHE(cache);
> +	u64 dev_bytes = (u64)cache->dev_size << SECTOR_SHIFT;
>  
>  	key->off = key_onmedia->off;
>  	key->len = key_onmedia->len;
>  
> +	if (key_onmedia->len == 0 ||
> +	    key_onmedia->len > dev_bytes ||
> +	    key_onmedia->off > dev_bytes - key_onmedia->len) {
> +		pcache_dev_err(pcache, "key off %llu + len %u exceeds device size\n",
> +				key_onmedia->off, key_onmedia->len);
> +		return -EIO;
> +	}
> +
>  	key->cache_pos.cache_seg = &cache->segments[key_onmedia->cache_seg_id];
>  	key->cache_pos.seg_off = key_onmedia->cache_seg_off;
>  
> -- 
> 2.53.0
> 
> 

Does not apply :(