Re: [PATCH] btrfs: send: fix buffer overflow detection when copying path to cache entry

[Wang Yugui <wangyugui@e16-tech.com>]

Hi,

> From: Filipe Manana <fdmanana@suse.com>
> 
> Starting with commit c0247d289e73 ("btrfs: send: annotate struct
> name_cache_entry with __counted_by()") we annotated the variable length
> array "name" from the name_cache_entry structure with __counted_by() to
> improve overflow detection. However that alone was not correct, because
> the length of that array does not match the "name_len" field - it matches
> that plus 1 to include the nul string terminador, so that makes a
> fortified kernel think there's an overflow and report a splat like this:

xfstests generic/591 failed with this patch.

generic/591 1s ... - output mismatch (see
/usr/hpc-bio/xfstests/results//generic/591.out.bad)
    --- tests/generic/591.out   2024-08-06 21:26:52.100477701 +0800
    +++ /usr/hpc-bio/xfstests/results//generic/591.out.bad      2024-09-22 06:00:37.920543850 +0800
    @@ -1,5 +1,10 @@
     QA output created by 591
     concurrent reader with O_DIRECT
    +splice-test: open: /mnt/test/a: Is a directory
     concurrent reader without O_DIRECT
    +splice-test: open: /mnt/test/a: Is a directory
     sequential reader with O_DIRECT
    +splice-test: open: /mnt/test/a: Is a directory
    ...
    (Run 'diff -u /usr/hpc-bio/xfstests/tests/generic/591.out /usr/hpc-bio/xfstests/results//generic/591.out.bad'  to see the entire diff)
R

Best Regards
Wang Yugui (wangyugui@e16-tech.com)
2024/09/22