Commit 205da7c0 authored by Kent Overstreet's avatar Kent Overstreet
Browse files

bcachefs: Don't trust sb->nr_devices in members_to_text() 



We have to be able to print superblock sections even if they fail to
validate (for debugging), so we have to calculate the number of entries
from the field size.

Reported-by: default avatar <syzbot+5138f00559ffb3cb3610@syzkaller.appspotmail.com>
Signed-off-by: default avatarKent Overstreet <kent.overstreet@linux.dev>
parent 625c494d

fs/bcachefs/sb-members.c

+30 −4
Original line number Diff line number Diff line
@@ -325,9 +325,17 @@ static void bch2_sb_members_v1_to_text(struct printbuf *out, struct bch_sb *sb, 
{

	struct bch_sb_field_members_v1 *mi = field_to_type(f, members_v1);

	struct bch_sb_field_disk_groups *gi = bch2_sb_field_get(sb, disk_groups);

	unsigned i;



	for (i = 0; i < sb->nr_devices; i++)

	if (vstruct_end(&mi->field) <= (void *) &mi->_members[0]) {

		prt_printf(out, "field ends before start of entries");

		return;

	}



	unsigned nr = (vstruct_end(&mi->field) - (void *) &mi->_members[0]) / sizeof(mi->_members[0]);

	if (nr != sb->nr_devices)

		prt_printf(out, "nr_devices mismatch: have %i entries, should be %u", nr, sb->nr_devices);



	for (unsigned i = 0; i < min(sb->nr_devices, nr); i++)

		member_to_text(out, members_v1_get(mi, i), gi, sb, i);

}
@@ -341,9 +349,27 @@ static void bch2_sb_members_v2_to_text(struct printbuf *out, struct bch_sb *sb, 
{

	struct bch_sb_field_members_v2 *mi = field_to_type(f, members_v2);

	struct bch_sb_field_disk_groups *gi = bch2_sb_field_get(sb, disk_groups);

	unsigned i;



	for (i = 0; i < sb->nr_devices; i++)

	if (vstruct_end(&mi->field) <= (void *) &mi->_members[0]) {

		prt_printf(out, "field ends before start of entries");

		return;

	}



	if (!le16_to_cpu(mi->member_bytes)) {

		prt_printf(out, "member_bytes 0");

		return;

	}



	unsigned nr = (vstruct_end(&mi->field) - (void *) &mi->_members[0]) / le16_to_cpu(mi->member_bytes);

	if (nr != sb->nr_devices)

		prt_printf(out, "nr_devices mismatch: have %i entries, should be %u", nr, sb->nr_devices);



	/*

	 * We call to_text() on superblock sections that haven't passed

	 * validate, so we can't trust sb->nr_devices.

	 */



	for (unsigned i = 0; i < min(sb->nr_devices, nr); i++)

		member_to_text(out, members_v2_get(mi, i), gi, sb, i);

}