This is a note to let you know that I've just added the patch titled btrfs: sysfs: validate scrub_speed_max value to the 6.7-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: btrfs-sysfs-validate-scrub_speed_max-value.patch and it can be found in the queue-6.7 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 2b0122aaa800b021e36027d7f29e206f87c761d6 Mon Sep 17 00:00:00 2001 From: David Disseldorp <ddiss@xxxxxxx> Date: Fri, 8 Dec 2023 11:41:56 +1100 Subject: btrfs: sysfs: validate scrub_speed_max value From: David Disseldorp <ddiss@xxxxxxx> commit 2b0122aaa800b021e36027d7f29e206f87c761d6 upstream. The value set as scrub_speed_max accepts size with suffixes (k/m/g/t/p/e) but we should still validate it for trailing characters, similar to what we do with chunk_size_store. CC: stable@xxxxxxxxxxxxxxx # 5.15+ Signed-off-by: David Disseldorp <ddiss@xxxxxxx> Reviewed-by: David Sterba <dsterba@xxxxxxxx> Signed-off-by: David Sterba <dsterba@xxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/btrfs/sysfs.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/btrfs/sysfs.c +++ b/fs/btrfs/sysfs.c @@ -1783,6 +1783,10 @@ static ssize_t btrfs_devinfo_scrub_speed unsigned long long limit; limit = memparse(buf, &endptr); + /* There could be trailing '\n', also catch any typos after the value. */ + endptr = skip_spaces(endptr); + if (*endptr != 0) + return -EINVAL; WRITE_ONCE(device->scrub_speed_max, limit); return len; } Patches currently in stable-queue which might be from ddiss@xxxxxxx are queue-6.7/btrfs-sysfs-validate-scrub_speed_max-value.patch