diff options
| author | Kent Overstreet <kent.overstreet@gmail.com> | 2021-04-24 00:42:02 -0400 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@gmail.com> | 2022-05-30 18:16:21 -0400 |
| commit | 7e1483d8c7ddf2c629433438d70e168a97b3d5a4 (patch) | |
| tree | a1dd7bb187e2a762a64e7c747c1b69874f50a892 /fs/bcachefs/btree_key_cache.c | |
| parent | 6130d768d7be66d13853eaa4ca308236f1a1e714 (diff) | |
bcachefs: Fix an out of bounds read
bch2_varint_decode() can read up to 7 bytes past the end of the buffer,
which means we need to allocate slightly larger key cache buffers.
Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
Diffstat (limited to 'fs/bcachefs/btree_key_cache.c')
| -rw-r--r-- | fs/bcachefs/btree_key_cache.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/fs/bcachefs/btree_key_cache.c b/fs/bcachefs/btree_key_cache.c index 8dec32057385..a5181a96397a 100644 --- a/fs/bcachefs/btree_key_cache.c +++ b/fs/bcachefs/btree_key_cache.c @@ -218,8 +218,14 @@ static int btree_key_cache_fill(struct btree_trans *trans, goto err; } - if (k.k->u64s > ck->u64s) { - new_u64s = roundup_pow_of_two(k.k->u64s); + /* + * bch2_varint_decode can read past the end of the buffer by at + * most 7 bytes (it won't be used): + */ + new_u64s = k.k->u64s + 1; + + if (new_u64s > ck->u64s) { + new_u64s = roundup_pow_of_two(new_u64s); new_k = kmalloc(new_u64s * sizeof(u64), GFP_NOFS); if (!new_k) { ret = -ENOMEM; |