Skip to content

Commit 657d428

Browse files
author
Kent Overstreet
committed
bcachefs: Fix journal_entry_dev_usage_to_text() overrun
If the jset_entry_dev_usage is malformed, and too small, our nr_entries calculation will be incorrect - just bail out. Reported-by: [email protected] Signed-off-by: Kent Overstreet <[email protected]>
1 parent 2642084 commit 657d428

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

fs/bcachefs/journal_io.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -708,6 +708,9 @@ static void journal_entry_dev_usage_to_text(struct printbuf *out, struct bch_fs
708708
container_of(entry, struct jset_entry_dev_usage, entry);
709709
unsigned i, nr_types = jset_entry_dev_usage_nr_types(u);
710710

711+
if (vstruct_bytes(entry) < sizeof(*u))
712+
return;
713+
711714
prt_printf(out, "dev=%u", le32_to_cpu(u->dev));
712715

713716
printbuf_indent_add(out, 2);

0 commit comments

Comments
 (0)