bcachefs: Fix unsafety in bch2_dirent_name_bytes()

Kent Overstreet · Kent Overstreet · commit 2195b755ebd2 · 2024-05-22T19:14:36.000-04:00
Reported-by: syzbot+84fa6fb8c7f98b93cdea@syzkaller.appspotmail.com
Signed-off-by: Kent Overstreet &lt;kent.overstreet@linux.dev&gt;
diff --git a/fs/bcachefs/dirent.c b/fs/bcachefs/dirent.c
@@ -15,6 +15,9 @@
 
 static unsigned bch2_dirent_name_bytes(struct bkey_s_c_dirent d)
 {
+	if (bkey_val_bytes(d.k) < offsetof(struct bch_dirent, d_name))
+		return 0;
+
 	unsigned bkey_u64s = bkey_val_u64s(d.k);
 	unsigned bkey_bytes = bkey_u64s * sizeof(u64);
 	u64 last_u64 = ((u64*)d.v)[bkey_u64s - 1];

Original file line number	Diff line number	Diff line change
`@@ -15,6 +15,9 @@`
`15`	`15`
`16`	`16`	`static unsigned bch2_dirent_name_bytes(struct bkey_s_c_dirent d)`
`17`	`17`	`{`
	`18`	`+ if (bkey_val_bytes(d.k) < offsetof(struct bch_dirent, d_name))`
	`19`	`+ return 0;`
	`20`	`+`
`18`	`21`	`unsigned bkey_u64s = bkey_val_u64s(d.k);`
`19`	`22`	`unsigned bkey_bytes = bkey_u64s * sizeof(u64);`
`20`	`23`	`u64 last_u64 = ((u64*)d.v)[bkey_u64s - 1];`