diff options
| author | Kent Overstreet <kent.overstreet@gmail.com> | 2020-05-08 23:15:42 -0400 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@gmail.com> | 2022-03-12 20:11:35 -0500 |
| commit | d47190d6973544671c1b01293d2a0bb3698778f8 (patch) | |
| tree | 928047e45ce3d262e0a27ab2a611a51101a2be13 | |
| parent | b6022ab080b47fc69d46fae19f0efcacbedcd80e (diff) | |
bcachefs: Fix initialization of bounce mempools
When they were converted to kvpmalloc pools they weren't converted to
pass the actual size of the allocation. Oops.
Also, validate the real length in the zstd decompression path.
Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
| -rw-r--r-- | fs/bcachefs/compress.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/fs/bcachefs/compress.c b/fs/bcachefs/compress.c index e755f1f78e43..e110cc1b39a9 100644 --- a/fs/bcachefs/compress.c +++ b/fs/bcachefs/compress.c @@ -191,20 +191,23 @@ static int __bio_uncompress(struct bch_fs *c, struct bio *src, } case BCH_COMPRESSION_TYPE_zstd: { ZSTD_DCtx *ctx; - size_t len; + size_t real_src_len = le32_to_cpup(src_data.b); + + if (real_src_len > src_len - 4) + goto err; workspace = mempool_alloc(&c->decompress_workspace, GFP_NOIO); ctx = zstd_init_dctx(workspace, zstd_dctx_workspace_bound()); src_len = le32_to_cpup(src_data.b); - len = zstd_decompress_dctx(ctx, + ret = ZSTD_decompressDCtx(ctx, dst_data, dst_len, - src_data.b + 4, src_len); + src_data.b + 4, real_src_len); mempool_free(workspace, &c->decompress_workspace); - if (len != dst_len) + if (ret != dst_len) goto err; break; } @@ -533,7 +536,6 @@ void bch2_fs_compress_exit(struct bch_fs *c) static int __bch2_fs_compress_init(struct bch_fs *c, u64 features) { size_t max_extent = c->sb.encoded_extent_max << 9; - size_t order = get_order(max_extent); size_t decompress_workspace_size = 0; bool decompress_workspace_needed; ZSTD_parameters params = ZSTD_getParams(0, max_extent, 0); @@ -568,14 +570,14 @@ have_compressed: if (!mempool_initialized(&c->compression_bounce[READ])) { ret = mempool_init_kvpmalloc_pool(&c->compression_bounce[READ], - 1, order); + 1, max_extent); if (ret) goto out; } if (!mempool_initialized(&c->compression_bounce[WRITE])) { ret = mempool_init_kvpmalloc_pool(&c->compression_bounce[WRITE], - 1, order); + 1, max_extent); if (ret) goto out; } |