diff options
| author | Dan Robertson <dan@dlrobertson.com> | 2021-05-05 14:09:43 +0300 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@linux.dev> | 2023-10-23 00:09:03 +0300 |
| commit | faf1a5f41772984d492f9805ded9a34dcdce724d (patch) | |
| tree | 55dfc3db1850b9a45221e65c97faf58fed8b70dd /fs/bcachefs/chardev.c | |
| parent | 2b25de552f8a8d9cae5b54c83137c67e03ee1957 (diff) | |
| download | linux-faf1a5f41772984d492f9805ded9a34dcdce724d.tar.xz | |
bcachefs: Fix out of bounds read in fs usage ioctl
Fix a possible read out of bounds if bch2_ioctl_fs_usage is called when
replica_entries_bytes is set to a value that is smaller than the size
of bch_replicas_usage.
Signed-off-by: Dan Robertson <dan@dlrobertson.com>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Diffstat (limited to 'fs/bcachefs/chardev.c')
| -rw-r--r-- | fs/bcachefs/chardev.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/bcachefs/chardev.c b/fs/bcachefs/chardev.c index b0cbbb70161d..99f112072ae5 100644 --- a/fs/bcachefs/chardev.c +++ b/fs/bcachefs/chardev.c @@ -414,7 +414,8 @@ static long bch2_ioctl_fs_usage(struct bch_fs *c, struct bch_replicas_entry *src_e = cpu_replicas_entry(&c->replicas, i); - if (replicas_usage_next(dst_e) > dst_end) { + /* check that we have enough space for one replicas entry */ + if (dst_e + 1 > dst_end) { ret = -ERANGE; break; } |