From: Kent Overstreet <kent.overstreet@gmail.com>
Date: Thu, 30 May 2019 00:06:06 +0000 (-0400)
Subject: bcachefs: Don't overflow stack in bch2_extent_merge_inline()
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=1ae973345626fcd9cdb81fe856cabf7808a33140;p=linux.git

bcachefs: Don't overflow stack in bch2_extent_merge_inline()

Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
---

diff --git a/fs/bcachefs/bkey.h b/fs/bcachefs/bkey.h
index 45de61d492a4b..ba08d95aae6f9 100644
--- a/fs/bcachefs/bkey.h
+++ b/fs/bcachefs/bkey.h
@@ -41,10 +41,7 @@ struct bkey_s {
 
 #define bkey_next(_k)		vstruct_next(_k)
 
-static inline unsigned bkey_val_u64s(const struct bkey *k)
-{
-	return k->u64s - BKEY_U64s;
-}
+#define bkey_val_u64s(_k)	((_k)->u64s - BKEY_U64s)
 
 static inline size_t bkey_val_bytes(const struct bkey *k)
 {
diff --git a/fs/bcachefs/extents.c b/fs/bcachefs/extents.c
index c5a0d6c8e63ae..a5582a6f6ef67 100644
--- a/fs/bcachefs/extents.c
+++ b/fs/bcachefs/extents.c
@@ -1651,6 +1651,10 @@ static bool bch2_extent_merge_inline(struct bch_fs *c,
 
 	EBUG_ON(bkey_written(b, m));
 
+	if (bkey_val_u64s(l) > BKEY_EXTENT_VAL_U64s_MAX ||
+	    bkey_val_u64s(r) > BKEY_EXTENT_VAL_U64s_MAX)
+		return BCH_MERGE_NOMERGE;
+
 	/*
 	 * We need to save copies of both l and r, because we might get a
 	 * partial merge (which modifies both) and then fails to repack