kset_onmedia_valid(9)

πŸ“¦ version 7.3.1, in nixpkgs unstable

πŸ’… kset_onmedia_valid(9) β€” like, the vibe check for your kset header πŸŽ€

okay so bestie, welcome to the kset_onmedia_valid(9) page from the Kernel API Manual β€” yes it's a kernel manpage, no it's not boring, stay with me 🫢


✨ NAME ✨

kset_onmedia_valid β€” validate a kset header that got read in from the cache device. that's it, that's the job, and honestly? iconic πŸ’…


🌸 SYNOPSIS 🌸

bool kset_onmedia_valid (struct pcache_cache_kset_onmedia *kset_onmedia
);

yeah she takes one arg and hands you back a bool. simple queen behavior πŸ‘‘


πŸ¦‹ ARGUMENTS πŸ¦‹

  • kset_onmedia β€” pointer to the kset that was copied straight off the on-media metadata. like, this is the thing you're checking, bestie, be nice to it πŸ₯Ί

πŸ”₯ DESCRIPTION πŸ”₯

okay so here's the tea, and it's kind of a lot β˜•

the magic and the CRC are both attacker-computable β€” because the seed is a fixed public seed. so like, don't be out here trusting them with your life, they're giving "security theater" energy ngl πŸ’€

here's the actual danger zone: a non-last kset stores key_num keys inline. and both cache_kset_crc and the replay loop read struct_size(.., data, key_num) bytes out of a buffer that's only sized for PCACHE_KSET_KEYS_MAX keys. so key_num must be bounded before any of that use happens. not after, not "eventually", before. periodt 🚨

⚠️ like seriously bestie, bound key_num first. this is not a drill, this is a "read past the end of a buffer" situation and that's the bad kind of main character energy 😭

🧚 SEE ALSO 🧚

kernel file ./drivers/md/dm-pcache/cache.h plus the whole friend group:

go read those too, they're all slay in their own way πŸ’–


and that's the page!! brought to you by ./drivers/md/dm-pcache, dated October 2026, filed forever under kset_onmedia_valid(9) β€” mwah, go validate responsibly βœ¨πŸŽ€πŸ’œ

πŸ“¦ where this page comes from