Commit 657d4282 authored by Kent Overstreet's avatar Kent Overstreet
Browse files

bcachefs: Fix journal_entry_dev_usage_to_text() overrun 



If the jset_entry_dev_usage is malformed, and too small, our nr_entries
calculation will be incorrect - just bail out.

Reported-by: default avatar <syzbot+05d7520be047c9be86e0@syzkaller.appspotmail.com>
Signed-off-by: default avatarKent Overstreet <kent.overstreet@linux.dev>
parent 2642084f

fs/bcachefs/journal_io.c

+3 −0
Original line number Diff line number Diff line
@@ -708,6 +708,9 @@ static void journal_entry_dev_usage_to_text(struct printbuf *out, struct bch_fs 
		container_of(entry, struct jset_entry_dev_usage, entry);

	unsigned i, nr_types = jset_entry_dev_usage_nr_types(u);



	if (vstruct_bytes(entry) < sizeof(*u))

		return;



	prt_printf(out, "dev=%u", le32_to_cpu(u->dev));



	printbuf_indent_add(out, 2);