bcachefs: Fix shift overflows in replicas.c

We can't disallow unknown data_types in verify() - we have to preserve
them unchanged for backwards compat; that means we have to add a few
more guards.

Reported-by: syzbot+249018ea545364f78d04@syzkaller.appspotmail.com
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>

diff --git a/fs/bcachefs/replicas.c b/fs/bcachefs/replicas.c
index bd1d5d085e23365b6bab993c558901fc178f4d7f..d45b10bc531c504617e3063d79010725b0700dc5 100644 (file)
--- a/fs/bcachefs/replicas.c
+++ b/fs/bcachefs/replicas.c
@@ -524,13 +524,16 @@ int bch2_replicas_gc_start(struct bch_fs *c, unsigned typemask)
        c->replicas_gc.nr               = 0;
        c->replicas_gc.entry_size       = 0;
 
-       for_each_cpu_replicas_entry(&c->replicas, e)
-               if (!((1 << e->data_type) & typemask)) {
+       for_each_cpu_replicas_entry(&c->replicas, e) {
+               /* Preserve unknown data types */
+               if (e->data_type >= BCH_DATA_NR ||
+                   !((1 << e->data_type) & typemask)) {
                        c->replicas_gc.nr++;
                        c->replicas_gc.entry_size =
                                max_t(unsigned, c->replicas_gc.entry_size,
                                      replicas_entry_bytes(e));
                }
+       }
 
        c->replicas_gc.entries = kcalloc(c->replicas_gc.nr,
                                         c->replicas_gc.entry_size,
@@ -542,7 +545,8 @@ int bch2_replicas_gc_start(struct bch_fs *c, unsigned typemask)
        }
 
        for_each_cpu_replicas_entry(&c->replicas, e)
-               if (!((1 << e->data_type) & typemask))
+               if (e->data_type >= BCH_DATA_NR ||
+                   !((1 << e->data_type) & typemask))
                        memcpy(cpu_replicas_entry(&c->replicas_gc, i++),
                               e, c->replicas_gc.entry_size);
 
@@ -998,7 +1002,7 @@ unsigned bch2_sb_dev_has_data(struct bch_sb *sb, unsigned dev)
 {
        struct bch_sb_field_replicas *replicas;
        struct bch_sb_field_replicas_v0 *replicas_v0;
-       unsigned i, data_has = 0;
+       unsigned data_has = 0;
 
        replicas = bch2_sb_field_get(sb, replicas);
        replicas_v0 = bch2_sb_field_get(sb, replicas_v0);
@@ -1006,17 +1010,26 @@ unsigned bch2_sb_dev_has_data(struct bch_sb *sb, unsigned dev)
        if (replicas) {
                struct bch_replicas_entry_v1 *r;
 
-               for_each_replicas_entry(replicas, r)
-                       for (i = 0; i < r->nr_devs; i++)
+               for_each_replicas_entry(replicas, r) {
+                       if (r->data_type >= sizeof(data_has) * 8)
+                               continue;
+
+                       for (unsigned i = 0; i < r->nr_devs; i++)
                                if (r->devs[i] == dev)
                                        data_has |= 1 << r->data_type;
+               }
+
        } else if (replicas_v0) {
                struct bch_replicas_entry_v0 *r;
 
-               for_each_replicas_entry_v0(replicas_v0, r)
-                       for (i = 0; i < r->nr_devs; i++)
+               for_each_replicas_entry_v0(replicas_v0, r) {
+                       if (r->data_type >= sizeof(data_has) * 8)
+                               continue;
+
+                       for (unsigned i = 0; i < r->nr_devs; i++)
                                if (r->devs[i] == dev)
                                        data_has |= 1 << r->data_type;
+               }
        }