diff options
| author | Dan Robertson <dan@dlrobertson.com> | 2021-05-05 07:09:43 -0400 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@linux.dev> | 2022-10-03 22:51:23 -0400 |
| commit | a44ab771fabaed3ad2b4ec9723583ec7bf4ea84e (patch) | |
| tree | e1649facf34dd4f0f5a9e7fd7048c91895f0db47 | |
| parent | f39770c6e1d0c27aa0cb12b5142323841abeb4b9 (diff) | |
bcachefs: Fix out of bounds read in fs usage ioctl
Fix a possible read out of bounds if bch2_ioctl_fs_usage is called when
replica_entries_bytes is set to a value that is smaller than the size
of bch_replicas_usage.
Signed-off-by: Dan Robertson <dan@dlrobertson.com>
| -rw-r--r-- | fs/bcachefs/chardev.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/bcachefs/chardev.c b/fs/bcachefs/chardev.c index ba8873ccde6c..c29f8272e682 100644 --- a/fs/bcachefs/chardev.c +++ b/fs/bcachefs/chardev.c @@ -414,7 +414,8 @@ static long bch2_ioctl_fs_usage(struct bch_fs *c, struct bch_replicas_entry *src_e = cpu_replicas_entry(&c->replicas, i); - if (replicas_usage_next(dst_e) > dst_end) { + /* check that we have enough space for one replicas entry */ + if (dst_e + 1 > dst_end) { ret = -ERANGE; break; } |