From 5bc38f44fa8e938044bb3b69c8881f3682fe97f6 Mon Sep 17 00:00:00 2001 From: Dan Robertson Date: Fri, 7 May 2021 22:29:02 -0400 Subject: [PATCH] bcachefs: Fix oob write in __bch2_btree_node_write Fix a possible out of bounds write in __bch2_btree_node_write when the data buffer padding is cleared up to the block size. The out of bounds write is possible if the data buffers size is not a multiple of the block size. Signed-off-by: Dan Robertson Signed-off-by: Kent Overstreet --- fs/bcachefs/btree_io.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/bcachefs/btree_io.c b/fs/bcachefs/btree_io.c index 389524ce1fb6..dbaa05ac764c 100644 --- a/fs/bcachefs/btree_io.c +++ b/fs/bcachefs/btree_io.c @@ -1500,6 +1500,9 @@ void __bch2_btree_node_write(struct bch_fs *c, struct btree *b) /* bch2_varint_decode may read up to 7 bytes past the end of the buffer: */ bytes += 8; + /* buffer must be a multiple of the block size */ + bytes = round_up(bytes, block_bytes(c)); + data = btree_bounce_alloc(c, bytes, &used_mempool); if (!b->written) {