system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-30 00:10:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

bcachefs; guard against overflow in btree node split

Browse source 
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
This commit is contained in:
Kent Overstreet 2023-12-17 23:31:26 -05:00
parent 0fa3b97767
commit 7ba1f6ec97
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
fs/bcachefs/btree_update_interior.c
View file

@ -1346,8 +1346,11 @@ static void __btree_split_node(struct btree_update *as,
struct bkey_packed *out[2];
struct bkey uk;
unsigned u64s, n1_u64s = (b->nr.live_u64s * 3) / 5;
struct { unsigned nr_keys, val_u64s; } nr_keys[2];
int i;
memset(&nr_keys, 0, sizeof(nr_keys));
for (i = 0; i < 2; i++) {
BUG_ON(n[i]->nsets != 1);
@ -1369,6 +1372,9 @@ static void __btree_split_node(struct btree_update *as,
if (!i)
n1_pos = uk.p;
bch2_bkey_format_add_key(&format[i], &uk);
nr_keys[i].nr_keys++;
nr_keys[i].val_u64s += bkeyp_val_u64s(&b->format, k);
}
btree_set_min(n[0], b->data->min_key);
@ -1381,6 +1387,12 @@ static void __btree_split_node(struct btree_update *as,
bch2_bkey_format_add_pos(&format[i], n[i]->data->max_key);
n[i]->data->format = bch2_bkey_format_done(&format[i]);
unsigned u64s = nr_keys[i].nr_keys * n[i]->data->format.key_u64s +
nr_keys[i].val_u64s;
if (__vstruct_bytes(struct btree_node, u64s) > btree_bytes(as->c))
n[i]->data->format = b->format;
btree_node_set_format(n[i], n[i]->data->format);
}