* Re: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
2024-05-07 9:19 ` [PATCH] bcachefs: fix oob " Edward Adam Davis
@ 2024-05-07 14:14 ` Kent Overstreet
2024-05-08 0:49 ` Edward Adam Davis
2024-05-07 23:18 ` kernel test robot
` (2 subsequent siblings)
3 siblings, 1 reply; 12+ messages in thread
From: Kent Overstreet @ 2024-05-07 14:14 UTC (permalink / raw)
To: Edward Adam Davis
Cc: syzbot+c48865e11e7e893ec4ab, bfoster, linux-bcachefs,
linux-fsdevel, linux-kernel, syzkaller-bugs
On Tue, May 07, 2024 at 05:19:29PM +0800, Edward Adam Davis wrote:
> When got too small clean field, entry will never equal vstruct_end(&clean->field),
> the dead loop resulted in out of bounds access.
>
> Fixes: 12bf93a429c9 ("bcachefs: Add .to_text() methods for all superblock sections")
> Fixes: a37ad1a3aba9 ("bcachefs: sb-clean.c")
> Reported-and-tested-by: syzbot+c48865e11e7e893ec4ab@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
I've already got a patch up for this - the validation was missing as
well.
commit f39055220f6f98a180e3503fe05bbf9921c425c8
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Sun May 5 22:28:00 2024 -0400
bcachefs: Add missing validation for superblock section clean
We were forgetting to check for jset entries that overrun the end of the
section - both in validate and to_text(); to_text() needs to be safe for
types that fail to validate.
Reported-by: syzbot+c48865e11e7e893ec4ab@syzkaller.appspotmail.com
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
diff --git a/fs/bcachefs/sb-clean.c b/fs/bcachefs/sb-clean.c
index 35ca3f138de6..194e55b11137 100644
--- a/fs/bcachefs/sb-clean.c
+++ b/fs/bcachefs/sb-clean.c
@@ -278,6 +278,17 @@ static int bch2_sb_clean_validate(struct bch_sb *sb,
return -BCH_ERR_invalid_sb_clean;
}
+ for (struct jset_entry *entry = clean->start;
+ entry != vstruct_end(&clean->field);
+ entry = vstruct_next(entry)) {
+ if ((void *) vstruct_next(entry) > vstruct_end(&clean->field)) {
+ prt_str(err, "entry type ");
+ bch2_prt_jset_entry_type(err, le16_to_cpu(entry->type));
+ prt_str(err, " overruns end of section");
+ return -BCH_ERR_invalid_sb_clean;
+ }
+ }
+
return 0;
}
@@ -295,6 +306,9 @@ static void bch2_sb_clean_to_text(struct printbuf *out, struct bch_sb *sb,
for (entry = clean->start;
entry != vstruct_end(&clean->field);
entry = vstruct_next(entry)) {
+ if ((void *) vstruct_next(entry) > vstruct_end(&clean->field))
+ break;
+
if (entry->type == BCH_JSET_ENTRY_btree_keys &&
!entry->u64s)
continue;
^ permalink raw reply related [flat|nested] 12+ messages in thread* Re: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
2024-05-07 14:14 ` Kent Overstreet
@ 2024-05-08 0:49 ` Edward Adam Davis
2024-05-08 0:59 ` Kent Overstreet
0 siblings, 1 reply; 12+ messages in thread
From: Edward Adam Davis @ 2024-05-08 0:49 UTC (permalink / raw)
To: kent.overstreet
Cc: bfoster, eadavis, linux-bcachefs, linux-fsdevel, linux-kernel,
syzbot+c48865e11e7e893ec4ab, syzkaller-bugs
On Tue, 7 May 2024 10:14:22 -0400, Kent Overstreet wrote:
> > When got too small clean field, entry will never equal vstruct_end(&clean->field),
> > the dead loop resulted in out of bounds access.
> >
> > Fixes: 12bf93a429c9 ("bcachefs: Add .to_text() methods for all superblock sections")
> > Fixes: a37ad1a3aba9 ("bcachefs: sb-clean.c")
> > Reported-and-tested-by: syzbot+c48865e11e7e893ec4ab@syzkaller.appspotmail.com
> > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
>
> I've already got a patch up for this - the validation was missing as
> well.
>
> commit f39055220f6f98a180e3503fe05bbf9921c425c8
> Author: Kent Overstreet <kent.overstreet@linux.dev>
> Date: Sun May 5 22:28:00 2024 -0400
>
> bcachefs: Add missing validation for superblock section clean
>
> We were forgetting to check for jset entries that overrun the end of the
> section - both in validate and to_text(); to_text() needs to be safe for
> types that fail to validate.
>
> Reported-by: syzbot+c48865e11e7e893ec4ab@syzkaller.appspotmail.com
> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
>
> diff --git a/fs/bcachefs/sb-clean.c b/fs/bcachefs/sb-clean.c
> index 35ca3f138de6..194e55b11137 100644
> --- a/fs/bcachefs/sb-clean.c
> +++ b/fs/bcachefs/sb-clean.c
> @@ -278,6 +278,17 @@ static int bch2_sb_clean_validate(struct bch_sb *sb,
> return -BCH_ERR_invalid_sb_clean;
> }
>
> + for (struct jset_entry *entry = clean->start;
> + entry != vstruct_end(&clean->field);
> + entry = vstruct_next(entry)) {
> + if ((void *) vstruct_next(entry) > vstruct_end(&clean->field)) {
> + prt_str(err, "entry type ");
> + bch2_prt_jset_entry_type(err, le16_to_cpu(entry->type));
> + prt_str(err, " overruns end of section");
> + return -BCH_ERR_invalid_sb_clean;
> + }
> + }
> +
The original judgment here is sufficient, there is no need to add this section of inspection.
> return 0;
> }
>
> @@ -295,6 +306,9 @@ static void bch2_sb_clean_to_text(struct printbuf *out, struct bch_sb *sb,
> for (entry = clean->start;
> entry != vstruct_end(&clean->field);
> entry = vstruct_next(entry)) {
> + if ((void *) vstruct_next(entry) > vstruct_end(&clean->field))
> + break;
> +
The same check has already been done in bch2_sb_clean_validate(), so it is unnecessary to redo it here.
> if (entry->type == BCH_JSET_ENTRY_btree_keys &&
> !entry->u64s)
> continue;
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
2024-05-08 0:49 ` Edward Adam Davis
@ 2024-05-08 0:59 ` Kent Overstreet
2024-05-08 1:11 ` Edward Adam Davis
0 siblings, 1 reply; 12+ messages in thread
From: Kent Overstreet @ 2024-05-08 0:59 UTC (permalink / raw)
To: Edward Adam Davis
Cc: bfoster, linux-bcachefs, linux-fsdevel, linux-kernel,
syzbot+c48865e11e7e893ec4ab, syzkaller-bugs
On Wed, May 08, 2024 at 08:49:39AM +0800, Edward Adam Davis wrote:
> On Tue, 7 May 2024 10:14:22 -0400, Kent Overstreet wrote:
> > > When got too small clean field, entry will never equal vstruct_end(&clean->field),
> > > the dead loop resulted in out of bounds access.
> > >
> > > Fixes: 12bf93a429c9 ("bcachefs: Add .to_text() methods for all superblock sections")
> > > Fixes: a37ad1a3aba9 ("bcachefs: sb-clean.c")
> > > Reported-and-tested-by: syzbot+c48865e11e7e893ec4ab@syzkaller.appspotmail.com
> > > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> >
> > I've already got a patch up for this - the validation was missing as
> > well.
> >
> > commit f39055220f6f98a180e3503fe05bbf9921c425c8
> > Author: Kent Overstreet <kent.overstreet@linux.dev>
> > Date: Sun May 5 22:28:00 2024 -0400
> >
> > bcachefs: Add missing validation for superblock section clean
> >
> > We were forgetting to check for jset entries that overrun the end of the
> > section - both in validate and to_text(); to_text() needs to be safe for
> > types that fail to validate.
> >
> > Reported-by: syzbot+c48865e11e7e893ec4ab@syzkaller.appspotmail.com
> > Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
> >
> > diff --git a/fs/bcachefs/sb-clean.c b/fs/bcachefs/sb-clean.c
> > index 35ca3f138de6..194e55b11137 100644
> > --- a/fs/bcachefs/sb-clean.c
> > +++ b/fs/bcachefs/sb-clean.c
> > @@ -278,6 +278,17 @@ static int bch2_sb_clean_validate(struct bch_sb *sb,
> > return -BCH_ERR_invalid_sb_clean;
> > }
> >
> > + for (struct jset_entry *entry = clean->start;
> > + entry != vstruct_end(&clean->field);
> > + entry = vstruct_next(entry)) {
> > + if ((void *) vstruct_next(entry) > vstruct_end(&clean->field)) {
> > + prt_str(err, "entry type ");
> > + bch2_prt_jset_entry_type(err, le16_to_cpu(entry->type));
> > + prt_str(err, " overruns end of section");
> > + return -BCH_ERR_invalid_sb_clean;
> > + }
> > + }
> > +
> The original judgment here is sufficient, there is no need to add this section of inspection.
No, we need to be able to print things that failed to validate so that
we see what went wrong.
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
2024-05-08 0:59 ` Kent Overstreet
@ 2024-05-08 1:11 ` Edward Adam Davis
2024-05-08 1:21 ` Kent Overstreet
0 siblings, 1 reply; 12+ messages in thread
From: Edward Adam Davis @ 2024-05-08 1:11 UTC (permalink / raw)
To: kent.overstreet
Cc: bfoster, eadavis, linux-bcachefs, linux-fsdevel, linux-kernel,
syzbot+c48865e11e7e893ec4ab, syzkaller-bugs
On Tue, 7 May 2024 20:59:14 -0400, Kent Overstreet wrote:
> > > diff --git a/fs/bcachefs/sb-clean.c b/fs/bcachefs/sb-clean.c
> > > index 35ca3f138de6..194e55b11137 100644
> > > --- a/fs/bcachefs/sb-clean.c
> > > +++ b/fs/bcachefs/sb-clean.c
> > > @@ -278,6 +278,17 @@ static int bch2_sb_clean_validate(struct bch_sb *sb,
> > > return -BCH_ERR_invalid_sb_clean;
> > > }
> > >
> > > + for (struct jset_entry *entry = clean->start;
> > > + entry != vstruct_end(&clean->field);
> > > + entry = vstruct_next(entry)) {
> > > + if ((void *) vstruct_next(entry) > vstruct_end(&clean->field)) {
> > > + prt_str(err, "entry type ");
> > > + bch2_prt_jset_entry_type(err, le16_to_cpu(entry->type));
> > > + prt_str(err, " overruns end of section");
> > > + return -BCH_ERR_invalid_sb_clean;
> > > + }
> > > + }
> > > +
> > The original judgment here is sufficient, there is no need to add this section of inspection.
>
> No, we need to be able to print things that failed to validate so that
> we see what went wrong.
The follow check work fine, why add above check ?
1 if (vstruct_bytes(&clean->field) < sizeof(*clean)) {
268 prt_printf(err, "wrong size (got %zu should be %zu)",
1 vstruct_bytes(&clean->field), sizeof(*clean));
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
2024-05-08 1:11 ` Edward Adam Davis
@ 2024-05-08 1:21 ` Kent Overstreet
2024-05-08 1:28 ` Edward Adam Davis
0 siblings, 1 reply; 12+ messages in thread
From: Kent Overstreet @ 2024-05-08 1:21 UTC (permalink / raw)
To: Edward Adam Davis
Cc: bfoster, linux-bcachefs, linux-fsdevel, linux-kernel,
syzbot+c48865e11e7e893ec4ab, syzkaller-bugs
On Wed, May 08, 2024 at 09:11:37AM +0800, Edward Adam Davis wrote:
> On Tue, 7 May 2024 20:59:14 -0400, Kent Overstreet wrote:
> > > > diff --git a/fs/bcachefs/sb-clean.c b/fs/bcachefs/sb-clean.c
> > > > index 35ca3f138de6..194e55b11137 100644
> > > > --- a/fs/bcachefs/sb-clean.c
> > > > +++ b/fs/bcachefs/sb-clean.c
> > > > @@ -278,6 +278,17 @@ static int bch2_sb_clean_validate(struct bch_sb *sb,
> > > > return -BCH_ERR_invalid_sb_clean;
> > > > }
> > > >
> > > > + for (struct jset_entry *entry = clean->start;
> > > > + entry != vstruct_end(&clean->field);
> > > > + entry = vstruct_next(entry)) {
> > > > + if ((void *) vstruct_next(entry) > vstruct_end(&clean->field)) {
> > > > + prt_str(err, "entry type ");
> > > > + bch2_prt_jset_entry_type(err, le16_to_cpu(entry->type));
> > > > + prt_str(err, " overruns end of section");
> > > > + return -BCH_ERR_invalid_sb_clean;
> > > > + }
> > > > + }
> > > > +
> > > The original judgment here is sufficient, there is no need to add this section of inspection.
> >
> > No, we need to be able to print things that failed to validate so that
> > we see what went wrong.
> The follow check work fine, why add above check ?
> 1 if (vstruct_bytes(&clean->field) < sizeof(*clean)) {
> 268 prt_printf(err, "wrong size (got %zu should be %zu)",
> 1 vstruct_bytes(&clean->field), sizeof(*clean));
>
You sure you're not inebriated?
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
2024-05-08 1:21 ` Kent Overstreet
@ 2024-05-08 1:28 ` Edward Adam Davis
0 siblings, 0 replies; 12+ messages in thread
From: Edward Adam Davis @ 2024-05-08 1:28 UTC (permalink / raw)
To: kent.overstreet
Cc: bfoster, eadavis, linux-bcachefs, linux-fsdevel, linux-kernel,
syzbot+c48865e11e7e893ec4ab, syzkaller-bugs
On Tue, 7 May 2024 21:21:16 -0400, Kent Overstreet wrote:
> > > > > diff --git a/fs/bcachefs/sb-clean.c b/fs/bcachefs/sb-clean.c
> > > > > index 35ca3f138de6..194e55b11137 100644
> > > > > --- a/fs/bcachefs/sb-clean.c
> > > > > +++ b/fs/bcachefs/sb-clean.c
> > > > > @@ -278,6 +278,17 @@ static int bch2_sb_clean_validate(struct bch_sb *sb,
> > > > > return -BCH_ERR_invalid_sb_clean;
> > > > > }
> > > > >
> > > > > + for (struct jset_entry *entry = clean->start;
> > > > > + entry != vstruct_end(&clean->field);
> > > > > + entry = vstruct_next(entry)) {
> > > > > + if ((void *) vstruct_next(entry) > vstruct_end(&clean->field)) {
> > > > > + prt_str(err, "entry type ");
> > > > > + bch2_prt_jset_entry_type(err, le16_to_cpu(entry->type));
> > > > > + prt_str(err, " overruns end of section");
> > > > > + return -BCH_ERR_invalid_sb_clean;
> > > > > + }
> > > > > + }
> > > > > +
> > > > The original judgment here is sufficient, there is no need to add this section of inspection.
> > >
> > > No, we need to be able to print things that failed to validate so that
> > > we see what went wrong.
> > The follow check work fine, why add above check ?
> > 1 if (vstruct_bytes(&clean->field) < sizeof(*clean)) {
> > 268 prt_printf(err, "wrong size (got %zu should be %zu)",
> > 1 vstruct_bytes(&clean->field), sizeof(*clean));
> >
>
> You sure you're not inebriated?
Here, is my test log, according to it, I can confirm what went wrong.
[ 129.350671][ T7772] bcachefs (/dev/loop0): error validating superblock: Invalid superblock section clean: wrong size (got 8 should be 24)
[ 129.350671][ T7772] clean (size 8):
[ 129.350671][ T7772] flags: 0
[ 129.350671][ T7772] journal_seq: 0
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
2024-05-07 9:19 ` [PATCH] bcachefs: fix oob " Edward Adam Davis
2024-05-07 14:14 ` Kent Overstreet
@ 2024-05-07 23:18 ` kernel test robot
2024-05-08 0:13 ` kernel test robot
2024-05-08 1:06 ` kernel test robot
3 siblings, 0 replies; 12+ messages in thread
From: kernel test robot @ 2024-05-07 23:18 UTC (permalink / raw)
To: Edward Adam Davis, syzbot+c48865e11e7e893ec4ab
Cc: llvm, oe-kbuild-all, bfoster, kent.overstreet, linux-bcachefs,
linux-fsdevel, linux-kernel, syzkaller-bugs
Hi Edward,
kernel test robot noticed the following build warnings:
[auto build test WARNING on linus/master]
[also build test WARNING on v6.9-rc7 next-20240507]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Edward-Adam-Davis/bcachefs-fix-oob-in-bch2_sb_clean_to_text/20240507-172635
base: linus/master
patch link: https://lore.kernel.org/r/tencent_816D842DE96C309554E8E2ED9ACC6078120A%40qq.com
patch subject: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
config: i386-buildonly-randconfig-005-20240508 (https://download.01.org/0day-ci/archive/20240508/202405080718.ZRZVFchD-lkp@intel.com/config)
compiler: clang version 18.1.4 (https://github.com/llvm/llvm-project e6c3289804a67ea0bb6a86fadbe454dd93b8d855)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240508/202405080718.ZRZVFchD-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202405080718.ZRZVFchD-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> fs/bcachefs/sb-clean.c:296:13: warning: comparison of distinct pointer types ('struct jset_entry *' and 'void *') [-Wcompare-distinct-pointer-types]
296 | entry < vstruct_end(&clean->field);
| ~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
vim +296 fs/bcachefs/sb-clean.c
283
284 static void bch2_sb_clean_to_text(struct printbuf *out, struct bch_sb *sb,
285 struct bch_sb_field *f)
286 {
287 struct bch_sb_field_clean *clean = field_to_type(f, clean);
288 struct jset_entry *entry;
289
290 prt_printf(out, "flags: %x", le32_to_cpu(clean->flags));
291 prt_newline(out);
292 prt_printf(out, "journal_seq: %llu", le64_to_cpu(clean->journal_seq));
293 prt_newline(out);
294
295 for (entry = clean->start;
> 296 entry < vstruct_end(&clean->field);
297 entry = vstruct_next(entry)) {
298 if (entry->type == BCH_JSET_ENTRY_btree_keys &&
299 !entry->u64s)
300 continue;
301
302 bch2_journal_entry_to_text(out, NULL, entry);
303 prt_newline(out);
304 }
305 }
306
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
2024-05-07 9:19 ` [PATCH] bcachefs: fix oob " Edward Adam Davis
2024-05-07 14:14 ` Kent Overstreet
2024-05-07 23:18 ` kernel test robot
@ 2024-05-08 0:13 ` kernel test robot
2024-05-08 1:06 ` kernel test robot
3 siblings, 0 replies; 12+ messages in thread
From: kernel test robot @ 2024-05-08 0:13 UTC (permalink / raw)
To: Edward Adam Davis, syzbot+c48865e11e7e893ec4ab
Cc: oe-kbuild-all, bfoster, kent.overstreet, linux-bcachefs,
linux-fsdevel, linux-kernel, syzkaller-bugs
Hi Edward,
kernel test robot noticed the following build warnings:
[auto build test WARNING on linus/master]
[also build test WARNING on v6.9-rc7 next-20240507]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Edward-Adam-Davis/bcachefs-fix-oob-in-bch2_sb_clean_to_text/20240507-172635
base: linus/master
patch link: https://lore.kernel.org/r/tencent_816D842DE96C309554E8E2ED9ACC6078120A%40qq.com
patch subject: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
config: i386-buildonly-randconfig-004-20240508 (https://download.01.org/0day-ci/archive/20240508/202405080720.SuCCdwWG-lkp@intel.com/config)
compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240508/202405080720.SuCCdwWG-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202405080720.SuCCdwWG-lkp@intel.com/
All warnings (new ones prefixed by >>):
fs/bcachefs/sb-clean.c: In function 'bch2_sb_clean_to_text':
>> fs/bcachefs/sb-clean.c:296:20: warning: comparison of distinct pointer types lacks a cast
296 | entry < vstruct_end(&clean->field);
| ^
vim +296 fs/bcachefs/sb-clean.c
283
284 static void bch2_sb_clean_to_text(struct printbuf *out, struct bch_sb *sb,
285 struct bch_sb_field *f)
286 {
287 struct bch_sb_field_clean *clean = field_to_type(f, clean);
288 struct jset_entry *entry;
289
290 prt_printf(out, "flags: %x", le32_to_cpu(clean->flags));
291 prt_newline(out);
292 prt_printf(out, "journal_seq: %llu", le64_to_cpu(clean->journal_seq));
293 prt_newline(out);
294
295 for (entry = clean->start;
> 296 entry < vstruct_end(&clean->field);
297 entry = vstruct_next(entry)) {
298 if (entry->type == BCH_JSET_ENTRY_btree_keys &&
299 !entry->u64s)
300 continue;
301
302 bch2_journal_entry_to_text(out, NULL, entry);
303 prt_newline(out);
304 }
305 }
306
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
2024-05-07 9:19 ` [PATCH] bcachefs: fix oob " Edward Adam Davis
` (2 preceding siblings ...)
2024-05-08 0:13 ` kernel test robot
@ 2024-05-08 1:06 ` kernel test robot
3 siblings, 0 replies; 12+ messages in thread
From: kernel test robot @ 2024-05-08 1:06 UTC (permalink / raw)
To: Edward Adam Davis, syzbot+c48865e11e7e893ec4ab
Cc: oe-kbuild-all, bfoster, kent.overstreet, linux-bcachefs,
linux-fsdevel, linux-kernel, syzkaller-bugs
Hi Edward,
kernel test robot noticed the following build warnings:
[auto build test WARNING on linus/master]
[also build test WARNING on v6.9-rc7 next-20240507]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Edward-Adam-Davis/bcachefs-fix-oob-in-bch2_sb_clean_to_text/20240507-172635
base: linus/master
patch link: https://lore.kernel.org/r/tencent_816D842DE96C309554E8E2ED9ACC6078120A%40qq.com
patch subject: [PATCH] bcachefs: fix oob in bch2_sb_clean_to_text
config: x86_64-randconfig-121-20240508 (https://download.01.org/0day-ci/archive/20240508/202405080823.um76blCH-lkp@intel.com/config)
compiler: clang version 18.1.4 (https://github.com/llvm/llvm-project e6c3289804a67ea0bb6a86fadbe454dd93b8d855)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240508/202405080823.um76blCH-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202405080823.um76blCH-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
fs/bcachefs/sb-clean.c: note: in included file:
fs/bcachefs/bcachefs.h:1027:9: sparse: sparse: array of flexible structures
fs/bcachefs/sb-clean.c: note: in included file (through fs/bcachefs/bcachefs.h):
fs/bcachefs/bcachefs_format.h:794:38: sparse: sparse: array of flexible structures
fs/bcachefs/bcachefs_format.h:1453:38: sparse: sparse: array of flexible structures
>> fs/bcachefs/sb-clean.c:296:20: sparse: sparse: incompatible types in comparison expression (different base types):
fs/bcachefs/sb-clean.c:296:20: sparse: struct jset_entry *
fs/bcachefs/sb-clean.c:296:20: sparse: void *
vim +296 fs/bcachefs/sb-clean.c
283
284 static void bch2_sb_clean_to_text(struct printbuf *out, struct bch_sb *sb,
285 struct bch_sb_field *f)
286 {
287 struct bch_sb_field_clean *clean = field_to_type(f, clean);
288 struct jset_entry *entry;
289
290 prt_printf(out, "flags: %x", le32_to_cpu(clean->flags));
291 prt_newline(out);
292 prt_printf(out, "journal_seq: %llu", le64_to_cpu(clean->journal_seq));
293 prt_newline(out);
294
295 for (entry = clean->start;
> 296 entry < vstruct_end(&clean->field);
297 entry = vstruct_next(entry)) {
298 if (entry->type == BCH_JSET_ENTRY_btree_keys &&
299 !entry->u64s)
300 continue;
301
302 bch2_journal_entry_to_text(out, NULL, entry);
303 prt_newline(out);
304 }
305 }
306
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 12+ messages in thread