48 lines
1.7 KiB
Diff
48 lines
1.7 KiB
Diff
|
From 2d66d3160dd7ee36bb8a42111516373ec1cc4d25 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Kent Overstreet <kent.overstreet@linux.dev>
|
||
|
|
Date: Mon, 25 Nov 2024 01:26:56 -0500
|
||
|
|
Subject: [PATCH 124/213] bcachefs: Fix dup/misordered check in btree node read
|
||
|
|
Content-Type: text/plain; charset="utf-8"
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
We were checking for out of order keys, but not duplicate keys.
|
||
|
|
|
||
|
|
Reported-by: syzbot+dedbd67513939979f84f@syzkaller.appspotmail.com
|
||
|
|
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
|
||
|
|
Signed-off-by: Alexander Miroshnichenko <alex@millerson.name>
|
||
|
|
---
|
||
|
|
fs/bcachefs/btree_io.c | 10 +++++++++-
|
||
|
|
1 file changed, 9 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/fs/bcachefs/btree_io.c b/fs/bcachefs/btree_io.c
|
||
|
|
index 89a42ee81e5c..2b5da566fbac 100644
|
||
|
|
--- a/fs/bcachefs/btree_io.c
|
||
|
|
+++ b/fs/bcachefs/btree_io.c
|
||
|
|
@@ -857,6 +857,14 @@ static bool bkey_packed_valid(struct bch_fs *c, struct btree *b,
|
||
|
|
return !__bch2_bkey_validate(c, u.s_c, btree_node_type(b), BCH_VALIDATE_silent);
|
||
|
|
}
|
||
|
|
|
||
|
|
+static inline int btree_node_read_bkey_cmp(const struct btree *b,
|
||
|
|
+ const struct bkey_packed *l,
|
||
|
|
+ const struct bkey_packed *r)
|
||
|
|
+{
|
||
|
|
+ return bch2_bkey_cmp_packed(b, l, r)
|
||
|
|
+ ?: (int) bkey_deleted(r) - (int) bkey_deleted(l);
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
static int validate_bset_keys(struct bch_fs *c, struct btree *b,
|
||
|
|
struct bset *i, int write,
|
||
|
|
bool have_retry, bool *saw_error)
|
||
|
|
@@ -917,7 +925,7 @@ static int validate_bset_keys(struct bch_fs *c, struct btree *b,
|
||
|
|
BSET_BIG_ENDIAN(i), write,
|
||
|
|
&b->format, k);
|
||
|
|
|
||
|
|
- if (prev && bkey_iter_cmp(b, prev, k) > 0) {
|
||
|
|
+ if (prev && btree_node_read_bkey_cmp(b, prev, k) >= 0) {
|
||
|
|
struct bkey up = bkey_unpack_key(b, prev);
|
||
|
|
|
||
|
|
printbuf_reset(&buf);
|
||
|
|
--
|
||
|
|
2.45.2
|
||
|
|
|