diff options
| author | Samuel Moelius <sam.moelius@trailofbits.com> | 2026-06-29 15:47:40 +0000 |
|---|---|---|
| committer | Mikulas Patocka <mpatocka@redhat.com> | 2026-07-08 22:33:34 +0200 |
| commit | d9c631e3fbd44246a2be781d26cfacbb9b8ec127 (patch) | |
| tree | 70cf75ae0984e3015cea10e76db6b8b06207e514 | |
| parent | 5bcd4d3058ebaf46ad2e163829d87dd4870c7a45 (diff) | |
| download | linux-next-d9c631e3fbd44246a2be781d26cfacbb9b8ec127.tar.gz linux-next-d9c631e3fbd44246a2be781d26cfacbb9b8ec127.zip | |
dm-pcache: reject option groups without values
The pcache target parses optional arguments as name/value pairs. A
table that advertises one optional argument and supplies only a
recognized option name, for example "cache_mode", reaches
parse_cache_opts() with argc == 1. The parser consumes the name,
decrements argc to zero, then calls dm_shift_arg() again for the value.
dm_shift_arg() returns NULL when no arguments remain, and the following
strcmp() dereferences that NULL pointer.
Check that each recognized option has a value before consuming it. This
keeps valid "cache_mode writeback" and "data_crc true/false" tables
unchanged while making malformed tables fail during target construction
with a precise missing-value error.
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Reviewed-by: Zheng Gu <cengku@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
| -rw-r--r-- | drivers/md/dm-pcache/dm_pcache.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/md/dm-pcache/dm_pcache.c b/drivers/md/dm-pcache/dm_pcache.c index 81c795c0400e..d5cfd162c063 100644 --- a/drivers/md/dm-pcache/dm_pcache.c +++ b/drivers/md/dm-pcache/dm_pcache.c @@ -168,6 +168,10 @@ static int parse_cache_opts(struct dm_pcache *pcache, struct dm_arg_set *as, argc--; if (!strcmp(arg, "cache_mode")) { + if (!argc) { + *error = "Missing value for cache_mode"; + return -EINVAL; + } arg = dm_shift_arg(as); if (!strcmp(arg, "writeback")) { opts->cache_mode = PCACHE_CACHE_MODE_WRITEBACK; @@ -177,6 +181,10 @@ static int parse_cache_opts(struct dm_pcache *pcache, struct dm_arg_set *as, } argc--; } else if (!strcmp(arg, "data_crc")) { + if (!argc) { + *error = "Missing value for data_crc"; + return -EINVAL; + } arg = dm_shift_arg(as); if (!strcmp(arg, "true")) { opts->data_crc = true; |