diff options
| author | Dan Robertson <dan@dlrobertson.com> | 2021-05-07 22:29:02 -0400 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@gmail.com> | 2021-05-19 15:33:47 -0400 |
| commit | 75bb309fc1a20060db057ab93de036d490be913e (patch) | |
| tree | 83031a95bc75f1845373fef75feb56458ec78038 | |
| parent | 1c171cd163f36b550f1d240f226a82faacf2b594 (diff) | |
bcachefs: Fix oob write in __bch2_btree_node_write
Fix a possible out of bounds write in __bch2_btree_node_write when
the data buffer padding is cleared up to the block size. The out of
bounds write is possible if the data buffers size is not a multiple
of the block size.
Signed-off-by: Dan Robertson <dan@dlrobertson.com>
| -rw-r--r-- | fs/bcachefs/btree_io.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/bcachefs/btree_io.c b/fs/bcachefs/btree_io.c index e609bc49cefe..094285bd1cc2 100644 --- a/fs/bcachefs/btree_io.c +++ b/fs/bcachefs/btree_io.c @@ -1491,6 +1491,9 @@ void __bch2_btree_node_write(struct bch_fs *c, struct btree *b) /* bch2_varint_decode may read up to 7 bytes past the end of the buffer: */ bytes += 8; + /* buffer must be a multiple of the block size */ + bytes = round_up(bytes, block_bytes(c)); + data = btree_bounce_alloc(c, bytes, &used_mempool); if (!b->written) { |