Commit a319aeae authored by Kent Overstreet's avatar Kent Overstreet
Browse files

bcachefs: Fix missing bounds checks in bch2_alloc_read() 



We were checking that the alloc key was for a valid device, but not a
valid bucket.

This is the upgrade path from versions prior to bcachefs being mainlined.

Reported-by: default avatar <syzbot+a1b59c8e1a3f022fd301@syzkaller.appspotmail.com>
Signed-off-by: default avatarKent Overstreet <kent.overstreet@linux.dev>
parent 573ddcdc

fs/bcachefs/alloc_background.c

+10 −0
Original line number Diff line number Diff line
@@ -639,6 +639,16 @@ int bch2_alloc_read(struct bch_fs *c) 
				continue;

			}



			if (k.k->p.offset < ca->mi.first_bucket) {

				bch2_btree_iter_set_pos(&iter, POS(k.k->p.inode, ca->mi.first_bucket));

				continue;

			}



			if (k.k->p.offset >= ca->mi.nbuckets) {

				bch2_btree_iter_set_pos(&iter, POS(k.k->p.inode + 1, 0));

				continue;

			}



			struct bch_alloc_v4 a;

			*bucket_gen(ca, k.k->p.offset) = bch2_alloc_to_v4(k, &a)->gen;

			0;