Re: [PATCH 7.2.y] dm-pcache: bound the logical key offset from persistent memory

[Greg KH <greg@kroah.com>]

On Wed, Sep 09, 2026 at 08:18:29PM -0400, Sasha Levin wrote:
> From: Bryam Vargas <hexlabsecurity@proton.me>
> 
> [ Upstream commit 97fc4b53dbe4a983fdf093243067fa6a64562307 ]
> 
> cache_key_decode() takes a key's logical off from the cache device and
> later indexes req_key_tree->subtrees[] by it in get_subtree(). An off
> past the device forms a subtree pointer outside the array, which
> rb_insert() writes through during replay.
> 
> Reject a key of zero length, or whose off+len (computed in 64 bits)
> exceeds the device size, before it is used.
> 
> Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
> Cc: stable@vger.kernel.org
> Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> [ adjusted context to account for the missing cache_seg_id_valid() check. ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/md/dm-pcache/cache_key.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
> index 51dd1ccf4e2fd..c98005d16fd6b 100644
> --- a/drivers/md/dm-pcache/cache_key.c
> +++ b/drivers/md/dm-pcache/cache_key.c
> @@ -90,10 +90,19 @@ int cache_key_decode(struct pcache_cache *cache,
>  			struct pcache_cache_key *key)
>  {
>  	struct dm_pcache *pcache = CACHE_TO_PCACHE(cache);
> +	u64 dev_bytes = (u64)cache->dev_size << SECTOR_SHIFT;
>  
>  	key->off = key_onmedia->off;
>  	key->len = key_onmedia->len;
>  
> +	if (key_onmedia->len == 0 ||
> +	    key_onmedia->len > dev_bytes ||
> +	    key_onmedia->off > dev_bytes - key_onmedia->len) {
> +		pcache_dev_err(pcache, "key off %llu + len %u exceeds device size\n",
> +				key_onmedia->off, key_onmedia->len);
> +		return -EIO;
> +	}
> +
>  	key->cache_pos.cache_seg = &cache->segments[key_onmedia->cache_seg_id];
>  	key->cache_pos.seg_off = key_onmedia->cache_seg_off;
>  
> -- 
> 2.53.0
> 
> 

Does not apply :(