Skip to content

Commit 657d428

Browse files
author
Kent Overstreet
committed
bcachefs: Fix journal_entry_dev_usage_to_text() overrun
If the jset_entry_dev_usage is malformed, and too small, our nr_entries calculation will be incorrect - just bail out. Reported-by: syzbot+05d7520be047c9be86e0@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
1 parent 2642084 commit 657d428

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

fs/bcachefs/journal_io.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -708,6 +708,9 @@ static void journal_entry_dev_usage_to_text(struct printbuf *out, struct bch_fs
708708
container_of(entry, struct jset_entry_dev_usage, entry);
709709
unsigned i, nr_types = jset_entry_dev_usage_nr_types(u);
710710

711+
if (vstruct_bytes(entry) < sizeof(*u))
712+
return;
713+
711714
prt_printf(out, "dev=%u", le32_to_cpu(u->dev));
712715

713716
printbuf_indent_add(out, 2);

0 commit comments

Comments
 (0)