bcachefs: Fix overflow in journal_replay_entry_early
authorKent Overstreet <kent.overstreet@gmail.com>
Fri, 11 Jun 2021 03:51:09 +0000 (23:51 -0400)
committerKent Overstreet <kent.overstreet@linux.dev>
Sun, 22 Oct 2023 21:09:06 +0000 (17:09 -0400)
If filesystem on disk was used by a version with a larger BCH_DATA_NR
thas the currently running version, we don't want this to cause a buffer
overrun.

Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
fs/bcachefs/recovery.c

index 9bd6348842e0733d90b881d03f773115cbaa5b87..f32414171aab82e062f6f3c43cd3f9a09e18d1e0 100644 (file)
@@ -725,7 +725,7 @@ static int journal_replay_entry_early(struct bch_fs *c,
                ca->usage_base->buckets_ec              = le64_to_cpu(u->buckets_ec);
                ca->usage_base->buckets_unavailable     = le64_to_cpu(u->buckets_unavailable);
 
-               for (i = 0; i < nr_types; i++) {
+               for (i = 0; i < min_t(unsigned, nr_types, BCH_DATA_NR); i++) {
                        ca->usage_base->d[i].buckets    = le64_to_cpu(u->d[i].buckets);
                        ca->usage_base->d[i].sectors    = le64_to_cpu(u->d[i].sectors);
                        ca->usage_base->d[i].fragmented = le64_to_cpu(u->d[i].fragmented);