From: Dan Robertson <dan@dlrobertson.com>
Date: Wed, 5 May 2021 11:09:43 +0000 (-0400)
Subject: bcachefs: Fix out of bounds read in fs usage ioctl
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=faf1a5f41772984d492f9805ded9a34dcdce724d;p=linux.git

bcachefs: Fix out of bounds read in fs usage ioctl

Fix a possible read out of bounds if bch2_ioctl_fs_usage is called when
replica_entries_bytes is set to a value that is smaller than the size
of bch_replicas_usage.

Signed-off-by: Dan Robertson <dan@dlrobertson.com>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
---

diff --git a/fs/bcachefs/chardev.c b/fs/bcachefs/chardev.c
index b0cbbb70161d0..99f112072ae52 100644
--- a/fs/bcachefs/chardev.c
+++ b/fs/bcachefs/chardev.c
@@ -414,7 +414,8 @@ static long bch2_ioctl_fs_usage(struct bch_fs *c,
 		struct bch_replicas_entry *src_e =
 			cpu_replicas_entry(&c->replicas, i);
 
-		if (replicas_usage_next(dst_e) > dst_end) {
+		/* check that we have enough space for one replicas entry */
+		if (dst_e + 1 > dst_end) {
 			ret = -ERANGE;
 			break;
 		}