[PATCH] bcachefs: Add missing accounting key type validation

[PATCH] bcachefs: Add missing accounting key type validation

[Alan Huang]

Reported-by: syzbot+cd063f869beedf5b9cd7@syzkaller.appspotmail.com
Signed-off-by: Alan Huang <mmpgouride@gmail.com>
---
 fs/bcachefs/disk_accounting.c  | 5 +++++
 fs/bcachefs/sb-errors_format.h | 3 ++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/bcachefs/disk_accounting.c b/fs/bcachefs/disk_accounting.c
index f96530c70262..4f5b290dc8f1 100644
--- a/fs/bcachefs/disk_accounting.c
+++ b/fs/bcachefs/disk_accounting.c
@@ -184,6 +184,11 @@ int bch2_accounting_validate(struct bch_fs *c, struct bkey_s_c k,
 	void *end = &acc_k + 1;
 	int ret = 0;
 
+	bkey_fsck_err_on(acc_k.type >= BCH_DISK_ACCOUNTING_TYPE_NR,
+			 c, accounting_key_type_invalid,
+			 "invalid accounting type (%u >= %u)",
+			 acc_k.type, BCH_DISK_ACCOUNTING_TYPE_NR);
+
 	bkey_fsck_err_on((from.flags & BCH_VALIDATE_commit) &&
 			 bversion_zero(k.k->bversion),
 			 c, accounting_key_version_0,
diff --git a/fs/bcachefs/sb-errors_format.h b/fs/bcachefs/sb-errors_format.h
index 5317b1bfe2e5..5ba28a684f51 100644
--- a/fs/bcachefs/sb-errors_format.h
+++ b/fs/bcachefs/sb-errors_format.h
@@ -328,6 +328,7 @@ enum bch_fsck_flags {
 	x(accounting_key_replicas_devs_unsorted,		280,	FSCK_AUTOFIX)	\
 	x(accounting_key_version_0,				282,	FSCK_AUTOFIX)	\
 	x(accounting_key_nr_counters_wrong,			307,	FSCK_AUTOFIX)	\
+	x(accounting_key_type_invalid,				325,	FSCK_AUTOFIX)	\
 	x(logged_op_but_clean,					283,	FSCK_AUTOFIX)	\
 	x(compression_opt_not_marked_in_sb,			295,	FSCK_AUTOFIX)	\
 	x(compression_type_not_marked_in_sb,			296,	FSCK_AUTOFIX)	\
@@ -336,7 +337,7 @@ enum bch_fsck_flags {
 	x(dirent_stray_data_after_cf_name,			305,	0)		\
 	x(rebalance_work_incorrectly_set,			309,	FSCK_AUTOFIX)	\
 	x(rebalance_work_incorrectly_unset,			310,	FSCK_AUTOFIX)	\
-	x(MAX,							325,	0)
+	x(MAX,							326,	0)
 
 enum bch_sb_error_id {
 #define x(t, n, ...) BCH_FSCK_ERR_##t = n,
-- 
2.49.0

Re: [PATCH] bcachefs: Add missing accounting key type validation

[Kent Overstreet]

On Tue, Aug 05, 2025 at 12:02:24AM +0800, Alan Huang wrote:
> Reported-by: syzbot+cd063f869beedf5b9cd7@syzkaller.appspotmail.com
> Signed-off-by: Alan Huang <mmpgouride@gmail.com>
> ---
>  fs/bcachefs/disk_accounting.c  | 5 +++++
>  fs/bcachefs/sb-errors_format.h | 3 ++-
>  2 files changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/bcachefs/disk_accounting.c b/fs/bcachefs/disk_accounting.c
> index f96530c70262..4f5b290dc8f1 100644
> --- a/fs/bcachefs/disk_accounting.c
> +++ b/fs/bcachefs/disk_accounting.c
> @@ -184,6 +184,11 @@ int bch2_accounting_validate(struct bch_fs *c, struct bkey_s_c k,
>  	void *end = &acc_k + 1;
>  	int ret = 0;
>  
> +	bkey_fsck_err_on(acc_k.type >= BCH_DISK_ACCOUNTING_TYPE_NR,
> +			 c, accounting_key_type_invalid,
> +			 "invalid accounting type (%u >= %u)",
> +			 acc_k.type, BCH_DISK_ACCOUNTING_TYPE_NR);
> +

No, this isn't a validate error - this breaks forwards compatibility.

Other code paths just need to silently ignore unknown accounting types.

>  	bkey_fsck_err_on((from.flags & BCH_VALIDATE_commit) &&
>  			 bversion_zero(k.k->bversion),
>  			 c, accounting_key_version_0,
> diff --git a/fs/bcachefs/sb-errors_format.h b/fs/bcachefs/sb-errors_format.h
> index 5317b1bfe2e5..5ba28a684f51 100644
> --- a/fs/bcachefs/sb-errors_format.h
> +++ b/fs/bcachefs/sb-errors_format.h
> @@ -328,6 +328,7 @@ enum bch_fsck_flags {
>  	x(accounting_key_replicas_devs_unsorted,		280,	FSCK_AUTOFIX)	\
>  	x(accounting_key_version_0,				282,	FSCK_AUTOFIX)	\
>  	x(accounting_key_nr_counters_wrong,			307,	FSCK_AUTOFIX)	\
> +	x(accounting_key_type_invalid,				325,	FSCK_AUTOFIX)	\
>  	x(logged_op_but_clean,					283,	FSCK_AUTOFIX)	\
>  	x(compression_opt_not_marked_in_sb,			295,	FSCK_AUTOFIX)	\
>  	x(compression_type_not_marked_in_sb,			296,	FSCK_AUTOFIX)	\
> @@ -336,7 +337,7 @@ enum bch_fsck_flags {
>  	x(dirent_stray_data_after_cf_name,			305,	0)		\
>  	x(rebalance_work_incorrectly_set,			309,	FSCK_AUTOFIX)	\
>  	x(rebalance_work_incorrectly_unset,			310,	FSCK_AUTOFIX)	\
> -	x(MAX,							325,	0)
> +	x(MAX,							326,	0)
>  
>  enum bch_sb_error_id {
>  #define x(t, n, ...) BCH_FSCK_ERR_##t = n,
> -- 
> 2.49.0
>