hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ID0C1D -------------------------------- Within ioinf_qos_write(), the value provided from user space is stored as s64, whereas params.inflight is defined as u32. If user space supplies inflight=4294967296, the assignment causes params.inflight to overflow to 0, subsequently triggering a divide-by-zero error. To prevent this, inflight values exceeding UINT_MAX are disallowed. Fixes: a63e78514d11 ("blk-ioinf: introduce inflight-based IO QoS controller") Signed-off-by: Baokun Li <libaokun1@huawei.com> --- block/blk-ioinf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/blk-ioinf.c b/block/blk-ioinf.c index 341be115f1d6..7432d88bf1f0 100644 --- a/block/blk-ioinf.c +++ b/block/blk-ioinf.c @@ -1144,7 +1144,7 @@ static ssize_t ioinf_qos_write(struct kernfs_open_file *of, char *input, params.enabled = !!v; continue; case INF_INFLIGHT: - if (match_u64(&args[0], &v) || v == 0) + if (match_u64(&args[0], &v) || v == 0 || v > UINT_MAX) goto einval; params.inflight = v; continue; -- 2.46.1