bcachefs: fix bounds checks in bch2_bio_map()

Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>

diff --git a/fs/bcachefs/util.c b/fs/bcachefs/util.c
index 75053322d0f03a22a614641e48f4e982c37efb19..ed90bd3a5d1889f404d38d3e771300217abbfe04 100644 (file)
--- a/fs/bcachefs/util.c
+++ b/fs/bcachefs/util.c
@@ -529,15 +529,17 @@ void bch2_bio_map(struct bio *bio, void *base)
 
        BUG_ON(!bio->bi_iter.bi_size);
        BUG_ON(bio->bi_vcnt);
+       BUG_ON(!bio->bi_max_vecs);
 
        bv->bv_offset = base ? offset_in_page(base) : 0;
        goto start;
 
        for (; size; bio->bi_vcnt++, bv++) {
+               BUG_ON(bio->bi_vcnt >= bio->bi_max_vecs);
+
                bv->bv_offset   = 0;
 start:         bv->bv_len      = min_t(size_t, PAGE_SIZE - bv->bv_offset,
                                        size);
-               BUG_ON(bio->bi_vcnt >= bio->bi_max_vecs);
                if (base) {
                        bv->bv_page = is_vmalloc_addr(base)
                                ? vmalloc_to_page(base)