bcachefs: Fix stack oob in __bch2_encrypt_bio()

Kent Overstreet · Kent Overstreet · commit 2ba24864d2f6 · 2024-05-22T19:01:17.000-04:00
Reported-by: syzbot+fff6b0fb00259873576a@syzkaller.appspotmail.com
Signed-off-by: Kent Overstreet &lt;kent.overstreet@linux.dev&gt;
diff --git a/fs/bcachefs/checksum.c b/fs/bcachefs/checksum.c
@@ -352,8 +352,12 @@ int __bch2_encrypt_bio(struct bch_fs *c, unsigned type,
 		bytes += bv.bv_len;
 	}
 
-	sg_mark_end(sg - 1);
-	return do_encrypt_sg(c->chacha20, nonce, sgl, bytes);
+	if (sg != sgl) {
+		sg_mark_end(sg - 1);
+		return do_encrypt_sg(c->chacha20, nonce, sgl, bytes);
+	}
+
+	return ret;
 }
 
 struct bch_csum bch2_checksum_merge(unsigned type, struct bch_csum a,

Original file line number	Diff line number	Diff line change
`@@ -352,8 +352,12 @@ int __bch2_encrypt_bio(struct bch_fs *c, unsigned type,`
`352`	`352`	`bytes += bv.bv_len;`
`353`	`353`	`}`
`354`	`354`
`355`		`- sg_mark_end(sg - 1);`
`356`		`- return do_encrypt_sg(c->chacha20, nonce, sgl, bytes);`
	`355`	`+ if (sg != sgl) {`
	`356`	`+ sg_mark_end(sg - 1);`
	`357`	`+ return do_encrypt_sg(c->chacha20, nonce, sgl, bytes);`
	`358`	`+ }`
	`359`	`+`
	`360`	`+ return ret;`
`357`	`361`	`}`
`358`	`362`
`359`	`363`	`struct bch_csum bch2_checksum_merge(unsigned type, struct bch_csum a,`