dm-pcache: validate the persisted dirty_tail chain at load

Browse source

The writeback worker follows the persisted dirty_tail chain, which is
decoded from the cache device independently of the key_tail chain that
cache_replay() walks and bounds. A crafted image, whose on-media fields are
authenticated only by a crc32c with a fixed seed, can aim dirty_tail at a
chain of last ksets that never terminates, so cache_writeback_fn() re-arms
itself with no delay forever.

Walk the dirty_tail chain once at load with the same hop cap cache_replay()
uses and fail the table load with -EIO if it does not reach an end within
n_segs hops.

Fixes: 1d57628ff9 ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

...

This commit is contained in:

Bryam Vargas 2026-07-17 06:27:03 -05:00 • committed by Mikulas Patocka

parent 62d92e45ab

commit 58d620ee9e

3 changed files with 78 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

7

drivers/md/dm-pcache/cache.c

View file

2

drivers/md/dm-pcache/cache.h

View file

69

drivers/md/dm-pcache/cache_key.c

View file