Commit bcfbaea8 authored by Kent Overstreet's avatar Kent Overstreet
Browse files

bcachefs: Fix shift overflows in replicas.c 



We can't disallow unknown data_types in verify() - we have to preserve
them unchanged for backwards compat; that means we have to add a few
more guards.

Reported-by: default avatar <syzbot+249018ea545364f78d04@syzkaller.appspotmail.com>
Signed-off-by: default avatarKent Overstreet <kent.overstreet@linux.dev>
parent f108ddd4

fs/bcachefs/replicas.c

+21 −8
Original line number Diff line number Diff line
@@ -524,13 +524,16 @@ int bch2_replicas_gc_start(struct bch_fs *c, unsigned typemask) 
	c->replicas_gc.nr		= 0;

	c->replicas_gc.entry_size	= 0;



	for_each_cpu_replicas_entry(&c->replicas, e)

		if (!((1 << e->data_type) & typemask)) {

	for_each_cpu_replicas_entry(&c->replicas, e) {

		/* Preserve unknown data types */

		if (e->data_type >= BCH_DATA_NR ||

		    !((1 << e->data_type) & typemask)) {

			c->replicas_gc.nr++;

			c->replicas_gc.entry_size =

				max_t(unsigned, c->replicas_gc.entry_size,

				      replicas_entry_bytes(e));

		}

	}



	c->replicas_gc.entries = kcalloc(c->replicas_gc.nr,

					 c->replicas_gc.entry_size,
@@ -542,7 +545,8 @@ int bch2_replicas_gc_start(struct bch_fs *c, unsigned typemask) 
	}



	for_each_cpu_replicas_entry(&c->replicas, e)

		if (!((1 << e->data_type) & typemask))

		if (e->data_type >= BCH_DATA_NR ||

		    !((1 << e->data_type) & typemask))

			memcpy(cpu_replicas_entry(&c->replicas_gc, i++),

			       e, c->replicas_gc.entry_size);
@@ -998,7 +1002,7 @@ unsigned bch2_sb_dev_has_data(struct bch_sb *sb, unsigned dev) 
{

	struct bch_sb_field_replicas *replicas;

	struct bch_sb_field_replicas_v0 *replicas_v0;

	unsigned i, data_has = 0;

	unsigned data_has = 0;



	replicas = bch2_sb_field_get(sb, replicas);

	replicas_v0 = bch2_sb_field_get(sb, replicas_v0);
@@ -1006,18 +1010,27 @@ unsigned bch2_sb_dev_has_data(struct bch_sb *sb, unsigned dev) 
	if (replicas) {

		struct bch_replicas_entry_v1 *r;



		for_each_replicas_entry(replicas, r)

			for (i = 0; i < r->nr_devs; i++)

		for_each_replicas_entry(replicas, r) {

			if (r->data_type >= sizeof(data_has) * 8)

				continue;



			for (unsigned i = 0; i < r->nr_devs; i++)

				if (r->devs[i] == dev)

					data_has |= 1 << r->data_type;

		}



	} else if (replicas_v0) {

		struct bch_replicas_entry_v0 *r;



		for_each_replicas_entry_v0(replicas_v0, r)

			for (i = 0; i < r->nr_devs; i++)

		for_each_replicas_entry_v0(replicas_v0, r) {

			if (r->data_type >= sizeof(data_has) * 8)

				continue;



			for (unsigned i = 0; i < r->nr_devs; i++)

				if (r->devs[i] == dev)

					data_has |= 1 << r->data_type;

		}

	}





	return data_has;