linux/drivers/md/bcache
Matthew Mirvish 3a861560cc bcache: fix variable length array abuse in btree_iter
btree_iter is used in two ways: either allocated on the stack with a
fixed size MAX_BSETS, or from a mempool with a dynamic size based on the
specific cache set. Previously, the struct had a fixed-length array of
size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized
iterators, which causes UBSAN to complain.

This patch uses the same approach as in bcachefs's sort_iter and splits
the iterator into a btree_iter with a flexible array member and a
btree_iter_stack which embeds a btree_iter as well as a fixed-length
data array.

Cc: stable@vger.kernel.org
Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039368
Signed-off-by: Matthew Mirvish <matthew@mm12.xyz>
Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20240509011117.2697-3-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2024-05-08 19:15:01 -06:00
..
alloc.c block: decouple REQ_OP_SECURE_ERASE from REQ_OP_DISCARD 2022-04-17 19:49:59 -06:00
bcache_ondisk.h flexible-array transformations for 6.3-rc1 2023-02-25 12:53:42 -08:00
bcache.h bcache: port block device access to files 2024-02-25 12:05:24 +01:00
bset.c bcache: fix variable length array abuse in btree_iter 2024-05-08 19:15:01 -06:00
bset.h bcache: fix variable length array abuse in btree_iter 2024-05-08 19:15:01 -06:00
btree.c bcache: fix variable length array abuse in btree_iter 2024-05-08 19:15:01 -06:00
btree.h Locking changes for v6.5: 2023-06-27 14:14:30 -07:00
debug.c block: turn bio_kmalloc into a simple kmalloc wrapper 2022-04-17 19:30:41 -06:00
debug.h
extents.c bcache: remove PTR_CACHE 2021-04-11 08:37:55 -06:00
extents.h
features.c bcache: move uapi header bcache.h to bcache code directory 2021-10-29 06:43:21 -06:00
features.h bcache: move uapi header bcache.h to bcache code directory 2021-10-29 06:43:21 -06:00
io.c block: pass a block_device and opf to bio_init 2022-02-02 07:49:59 -07:00
journal.c closures: CLOSURE_CALLBACK() to fix type punning 2023-11-24 00:29:58 -05:00
journal.h bcache: avoid journal no-space deadlock by reserving 1 journal bucket 2022-05-24 06:19:33 -06:00
Kconfig bcache: move closures to lib/ 2023-10-19 14:47:33 -04:00
Makefile bcache: move closures to lib/ 2023-10-19 14:47:33 -04:00
movinggc.c closures: CLOSURE_CALLBACK() to fix type punning 2023-11-24 00:29:58 -05:00
request.c closures: CLOSURE_CALLBACK() to fix type punning 2023-11-24 00:29:58 -05:00
request.h closures: CLOSURE_CALLBACK() to fix type punning 2023-11-24 00:29:58 -05:00
stats.c bcache: use default_groups in kobj_type 2022-01-26 15:56:18 +01:00
stats.h bcache: Remove dead references to cache_readaheads 2023-06-15 07:30:11 -06:00
super.c bcache: fix variable length array abuse in btree_iter 2024-05-08 19:15:01 -06:00
sysfs.c bcache: fix variable length array abuse in btree_iter 2024-05-08 19:15:01 -06:00
sysfs.h bcache: make kobj_type structures constant 2023-06-15 07:30:11 -06:00
trace.c
util.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
util.h bcache: move closures to lib/ 2023-10-19 14:47:33 -04:00
writeback.c bcache: fix variable length array abuse in btree_iter 2024-05-08 19:15:01 -06:00
writeback.h bcache: improve multithreaded bch_sectors_dirty_init() 2022-05-24 06:19:33 -06:00