* FAILED: patch "[PATCH] dm-pcache: reject a kset that overruns its segment" failed to apply to 7.2-stable tree
@ 2026-09-04 4:39 gregkh
2026-09-10 0:18 ` [PATCH 7.2.y] dm-pcache: reject a kset that overruns its segment Sasha Levin
0 siblings, 1 reply; 3+ messages in thread
From: gregkh @ 2026-09-04 4:39 UTC (permalink / raw)
To: hexlabsecurity, mpatocka; +Cc: stable
The patch below does not apply to the 7.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-7.2.y
git checkout FETCH_HEAD
git cherry-pick -x 7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026090425-mutiny-unsent-560b@gregkh' --subject-prefix 'PATCH 7.2.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb Mon Sep 17 00:00:00 2001
From: Bryam Vargas <hexlabsecurity@proton.me>
Date: Fri, 17 Jul 2026 06:26:58 -0500
Subject: [PATCH] dm-pcache: reject a kset that overruns its segment
cache_replay(), the writeback worker and the GC worker read a kset of
get_kset_onmedia_size() bytes and advance the position by it. A forged
key_num makes that size exceed the segment's remaining space, so the
advance walks past the segment and trips the cache_pos_advance() BUG_ON.
Reject a kset whose on-media size exceeds cache_seg_remain() before use.
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
diff --git a/drivers/md/dm-pcache/cache_gc.c b/drivers/md/dm-pcache/cache_gc.c
index 1ed513745023..c483c7a3afaf 100644
--- a/drivers/md/dm-pcache/cache_gc.c
+++ b/drivers/md/dm-pcache/cache_gc.c
@@ -146,6 +146,11 @@ void pcache_cache_gc_fn(struct work_struct *work)
continue;
}
+ if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(&key_tail)) {
+ atomic_inc(&cache->gc_errors);
+ return;
+ }
+
for (i = 0; i < kset_onmedia->key_num; i++) {
struct pcache_cache_key key_tmp = { 0 };
diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
index f4459b2e1b3b..d00497f9e462 100644
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -818,6 +818,11 @@ int cache_replay(struct pcache_cache *cache)
}
/* Replay the kset and check for errors. */
+ if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(pos)) {
+ ret = -EIO;
+ goto out;
+ }
+
ret = kset_replay(cache, kset_onmedia);
if (ret)
goto out;
diff --git a/drivers/md/dm-pcache/cache_writeback.c b/drivers/md/dm-pcache/cache_writeback.c
index 34c34b448e04..7a85a9aed18e 100644
--- a/drivers/md/dm-pcache/cache_writeback.c
+++ b/drivers/md/dm-pcache/cache_writeback.c
@@ -261,6 +261,11 @@ void cache_writeback_fn(struct work_struct *work)
goto queue_work;
}
+ if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(&dirty_tail)) {
+ atomic_inc(&cache->writeback_errors);
+ goto unlock;
+ }
+
ret = cache_kset_insert_tree(cache, kset_onmedia);
if (ret) {
atomic_inc(&cache->writeback_errors);
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 7.2.y] dm-pcache: reject a kset that overruns its segment
2026-09-04 4:39 FAILED: patch "[PATCH] dm-pcache: reject a kset that overruns its segment" failed to apply to 7.2-stable tree gregkh
@ 2026-09-10 0:18 ` Sasha Levin
2026-09-11 12:23 ` Greg KH
0 siblings, 1 reply; 3+ messages in thread
From: Sasha Levin @ 2026-09-10 0:18 UTC (permalink / raw)
To: stable; +Cc: Bryam Vargas, Mikulas Patocka, Sasha Levin
From: Bryam Vargas <hexlabsecurity@proton.me>
[ Upstream commit 7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb ]
cache_replay(), the writeback worker and the GC worker read a kset of
get_kset_onmedia_size() bytes and advance the position by it. A forged
key_num makes that size exceed the segment's remaining space, so the
advance walks past the segment and trips the cache_pos_advance() BUG_ON.
Reject a kset whose on-media size exceeds cache_seg_remain() before use.
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
[ backported missing writeback_errors support from the upstream dependency. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-pcache/cache.h | 1 +
drivers/md/dm-pcache/cache_gc.c | 5 +++++
drivers/md/dm-pcache/cache_key.c | 5 +++++
drivers/md/dm-pcache/cache_writeback.c | 8 ++++++++
4 files changed, 19 insertions(+)
diff --git a/drivers/md/dm-pcache/cache.h b/drivers/md/dm-pcache/cache.h
index afc112b79496a..93c1e699a3944 100644
--- a/drivers/md/dm-pcache/cache.h
+++ b/drivers/md/dm-pcache/cache.h
@@ -180,6 +180,7 @@ struct pcache_cache {
u32 advance;
int ret;
} writeback_ctx;
+ atomic_t writeback_errors;
char gc_kset_onmedia_buf[PCACHE_KSET_ONMEDIA_SIZE_MAX];
struct delayed_work gc_work;
diff --git a/drivers/md/dm-pcache/cache_gc.c b/drivers/md/dm-pcache/cache_gc.c
index 3088cfef951bc..99999a92c4e67 100644
--- a/drivers/md/dm-pcache/cache_gc.c
+++ b/drivers/md/dm-pcache/cache_gc.c
@@ -134,6 +134,11 @@ void pcache_cache_gc_fn(struct work_struct *work)
continue;
}
+ if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(&key_tail)) {
+ atomic_inc(&cache->gc_errors);
+ return;
+ }
+
for (i = 0; i < kset_onmedia->key_num; i++) {
struct pcache_cache_key key_tmp = { 0 };
diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
index 51dd1ccf4e2fd..93933651d2c96 100644
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -811,6 +811,11 @@ int cache_replay(struct pcache_cache *cache)
}
/* Replay the kset and check for errors. */
+ if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(pos)) {
+ ret = -EIO;
+ goto out;
+ }
+
ret = kset_replay(cache, kset_onmedia);
if (ret)
goto out;
diff --git a/drivers/md/dm-pcache/cache_writeback.c b/drivers/md/dm-pcache/cache_writeback.c
index 3df8687e2382f..656e4d0489121 100644
--- a/drivers/md/dm-pcache/cache_writeback.c
+++ b/drivers/md/dm-pcache/cache_writeback.c
@@ -229,6 +229,9 @@ void cache_writeback_fn(struct work_struct *work)
if (pcache_is_stopping(pcache))
goto unlock;
+ if (atomic_read(&cache->writeback_errors))
+ goto unlock;
+
kset_onmedia = (struct pcache_cache_kset_onmedia *)cache->wb_kset_onmedia_buf;
mutex_lock(&cache->dirty_tail_lock);
@@ -246,6 +249,11 @@ void cache_writeback_fn(struct work_struct *work)
goto queue_work;
}
+ if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(&dirty_tail)) {
+ atomic_inc(&cache->writeback_errors);
+ goto unlock;
+ }
+
ret = cache_kset_insert_tree(cache, kset_onmedia);
if (ret) {
delay = PCACHE_CACHE_WRITEBACK_INTERVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 7.2.y] dm-pcache: reject a kset that overruns its segment
2026-09-10 0:18 ` [PATCH 7.2.y] dm-pcache: reject a kset that overruns its segment Sasha Levin
@ 2026-09-11 12:23 ` Greg KH
0 siblings, 0 replies; 3+ messages in thread
From: Greg KH @ 2026-09-11 12:23 UTC (permalink / raw)
To: Sasha Levin; +Cc: stable, Bryam Vargas, Mikulas Patocka
On Wed, Sep 09, 2026 at 08:18:34PM -0400, Sasha Levin wrote:
> From: Bryam Vargas <hexlabsecurity@proton.me>
>
> [ Upstream commit 7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb ]
>
> cache_replay(), the writeback worker and the GC worker read a kset of
> get_kset_onmedia_size() bytes and advance the position by it. A forged
> key_num makes that size exceed the segment's remaining space, so the
> advance walks past the segment and trips the cache_pos_advance() BUG_ON.
>
> Reject a kset whose on-media size exceeds cache_seg_remain() before use.
>
> Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
> Cc: stable@vger.kernel.org
> Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> [ backported missing writeback_errors support from the upstream dependency. ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/md/dm-pcache/cache.h | 1 +
> drivers/md/dm-pcache/cache_gc.c | 5 +++++
> drivers/md/dm-pcache/cache_key.c | 5 +++++
> drivers/md/dm-pcache/cache_writeback.c | 8 ++++++++
> 4 files changed, 19 insertions(+)
>
> diff --git a/drivers/md/dm-pcache/cache.h b/drivers/md/dm-pcache/cache.h
> index afc112b79496a..93c1e699a3944 100644
> --- a/drivers/md/dm-pcache/cache.h
> +++ b/drivers/md/dm-pcache/cache.h
> @@ -180,6 +180,7 @@ struct pcache_cache {
> u32 advance;
> int ret;
> } writeback_ctx;
> + atomic_t writeback_errors;
>
> char gc_kset_onmedia_buf[PCACHE_KSET_ONMEDIA_SIZE_MAX];
> struct delayed_work gc_work;
> diff --git a/drivers/md/dm-pcache/cache_gc.c b/drivers/md/dm-pcache/cache_gc.c
> index 3088cfef951bc..99999a92c4e67 100644
> --- a/drivers/md/dm-pcache/cache_gc.c
> +++ b/drivers/md/dm-pcache/cache_gc.c
> @@ -134,6 +134,11 @@ void pcache_cache_gc_fn(struct work_struct *work)
> continue;
> }
>
> + if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(&key_tail)) {
> + atomic_inc(&cache->gc_errors);
> + return;
> + }
> +
> for (i = 0; i < kset_onmedia->key_num; i++) {
> struct pcache_cache_key key_tmp = { 0 };
>
> diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
> index 51dd1ccf4e2fd..93933651d2c96 100644
> --- a/drivers/md/dm-pcache/cache_key.c
> +++ b/drivers/md/dm-pcache/cache_key.c
> @@ -811,6 +811,11 @@ int cache_replay(struct pcache_cache *cache)
> }
>
> /* Replay the kset and check for errors. */
> + if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(pos)) {
> + ret = -EIO;
> + goto out;
> + }
> +
> ret = kset_replay(cache, kset_onmedia);
> if (ret)
> goto out;
> diff --git a/drivers/md/dm-pcache/cache_writeback.c b/drivers/md/dm-pcache/cache_writeback.c
> index 3df8687e2382f..656e4d0489121 100644
> --- a/drivers/md/dm-pcache/cache_writeback.c
> +++ b/drivers/md/dm-pcache/cache_writeback.c
> @@ -229,6 +229,9 @@ void cache_writeback_fn(struct work_struct *work)
> if (pcache_is_stopping(pcache))
> goto unlock;
>
> + if (atomic_read(&cache->writeback_errors))
> + goto unlock;
> +
> kset_onmedia = (struct pcache_cache_kset_onmedia *)cache->wb_kset_onmedia_buf;
>
> mutex_lock(&cache->dirty_tail_lock);
> @@ -246,6 +249,11 @@ void cache_writeback_fn(struct work_struct *work)
> goto queue_work;
> }
>
> + if (get_kset_onmedia_size(kset_onmedia) > cache_seg_remain(&dirty_tail)) {
> + atomic_inc(&cache->writeback_errors);
> + goto unlock;
> + }
> +
> ret = cache_kset_insert_tree(cache, kset_onmedia);
> if (ret) {
> delay = PCACHE_CACHE_WRITEBACK_INTERVAL;
> --
> 2.53.0
>
>
Does not apply :(
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-11 12:23 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-04 4:39 FAILED: patch "[PATCH] dm-pcache: reject a kset that overruns its segment" failed to apply to 7.2-stable tree gregkh
2026-09-10 0:18 ` [PATCH 7.2.y] dm-pcache: reject a kset that overruns its segment Sasha Levin
2026-09-11 12:23 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox