From: Yu Kuai <yukuai3@xxxxxxxxxx> 1) There are one place that return value of match_u64() is not checked. 2) If match_u64() failed, return value is set to -EINVAL despite that there are other possible errnos. Signed-off-by: Yu Kuai <yukuai3@xxxxxxxxxx> --- block/blk-iocost.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index fd495e823db2..c532129a1456 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -3202,6 +3202,7 @@ static ssize_t ioc_qos_write(struct kernfs_open_file *of, char *input, substring_t args[MAX_OPT_ARGS]; char buf[32]; int tok; + int err; s64 v; if (!*p) @@ -3209,7 +3210,12 @@ static ssize_t ioc_qos_write(struct kernfs_open_file *of, char *input, switch (match_token(p, qos_ctrl_tokens, args)) { case QOS_ENABLE: - match_u64(&args[0], &v); + err = match_u64(&args[0], &v); + if (err) { + ret = err; + goto out_unlock; + } + enable = v; continue; case QOS_CTRL: @@ -3238,8 +3244,12 @@ static ssize_t ioc_qos_write(struct kernfs_open_file *of, char *input, break; case QOS_RLAT: case QOS_WLAT: - if (match_u64(&args[0], &v)) + err = match_u64(&args[0], &v); + if (err) { + ret = err; goto out_unlock; + } + qos[tok] = v; break; case QOS_MIN: @@ -3374,6 +3384,7 @@ static ssize_t ioc_cost_model_write(struct kernfs_open_file *of, char *input, substring_t args[MAX_OPT_ARGS]; char buf[32]; int tok; + int err; u64 v; if (!*p) @@ -3399,8 +3410,13 @@ static ssize_t ioc_cost_model_write(struct kernfs_open_file *of, char *input, tok = match_token(p, i_lcoef_tokens, args); if (tok == NR_I_LCOEFS) goto out_unlock; - if (match_u64(&args[0], &v)) + + err = match_u64(&args[0], &v); + if (err) { + ret = err; goto out_unlock; + } + u[tok] = v; user = true; } -- 2.31.1