From 89ad7187624f2d1f0ef9d0acda2eb36b8a8d8b16 Mon Sep 17 00:00:00 2001 From: dongshengyuan <545258830@qq.com> Date: Fri, 24 Jul 2026 16:38:19 +0800 Subject: [PATCH 1/2] cryptsetup: don't keep invalid size= values size= is specified in bits, but arg_key_size stores bytes after parsing. The parser used arg_key_size as temporary storage before validation. When the value was not divisible by 8, the warning said the option was ignored, but the invalid bit count remained. Parse into a local variable and update arg_key_size only after validation. Repro: build/systemd-cryptsetup attach sdscan /tmp/plain.img /tmp/key \ plain,size=7 Before: warned ignored, then used key size 56 bits. After: warned ignored, then kept the default key size 256 bits. Follow-up for: 6131a78b4d247618715e042e14ad682f678d3b32 --- src/cryptsetup/cryptsetup.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c index 794983dcb6..379556f5d9 100644 --- a/src/cryptsetup/cryptsetup.c +++ b/src/cryptsetup/cryptsetup.c @@ -193,19 +193,20 @@ static int parse_one_option(const char *option) { return log_oom(); } else if ((val = startswith(option, "size="))) { + unsigned key_size; - r = safe_atou(val, &arg_key_size); + r = safe_atou(val, &key_size); if (r < 0) { log_warning_errno(r, "Failed to parse %s, ignoring: %m", option); return 0; } - if (arg_key_size % 8) { + if (key_size % 8) { log_warning("size= not a multiple of 8, ignoring."); return 0; } - arg_key_size /= 8; + arg_key_size = key_size / 8; } else if ((val = startswith(option, "sector-size="))) { From 33d9f3840b25a13b6fb8b188cb80ec32055197c1 Mon Sep 17 00:00:00 2001 From: dongshengyuan <545258830@qq.com> Date: Fri, 24 Jul 2026 16:38:19 +0800 Subject: [PATCH 2/2] cryptsetup: ignore invalid password-cache= fully password-cache= tracks both the cache mode and whether the option was configured explicitly. The parser set arg_password_cache_set before validating the value, so an invalid value was logged as ignored but still blocked the PKCS#11 default no-cache policy. Only mark password-cache= as configured after accepting read-only or a valid boolean. Repro: build/systemd-cryptsetup attach sdscan /dev/null - \ pkcs11-uri=auto,password-cache=bogus Before: warned ignored, then failed with the PKCS#11 cache error. After: warned ignored, then continued to the device check. Follow-up for: fd8ed7f26b5e365c27599bb6b223caaaa20dd2ca --- src/cryptsetup/cryptsetup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c index 379556f5d9..6aedf12df5 100644 --- a/src/cryptsetup/cryptsetup.c +++ b/src/cryptsetup/cryptsetup.c @@ -311,8 +311,6 @@ static int parse_one_option(const char *option) { SET_FLAG(arg_ask_password_flags, ASK_PASSWORD_SILENT, !r); } } else if ((val = startswith(option, "password-cache="))) { - arg_password_cache_set = true; - if (streq(val, "read-only")) { arg_ask_password_flags |= ASK_PASSWORD_ACCEPT_CACHED; arg_ask_password_flags &= ~ASK_PASSWORD_PUSH_CACHE; @@ -325,6 +323,8 @@ static int parse_one_option(const char *option) { SET_FLAG(arg_ask_password_flags, ASK_PASSWORD_ACCEPT_CACHED|ASK_PASSWORD_PUSH_CACHE, r); } + + arg_password_cache_set = true; } else if (STR_IN_SET(option, "allow-discards", "discard")) arg_discards = true; else if (streq(option, "same-cpu-crypt"))