Because the value of m.btree_bitmap_shift is 69 in this case, it cause shift-out-of-bounds in member_to_text.
Add a check for btree_bitmap_shift in validate_member, when it is greater than or equal to 64 return -BCH_ERR_invalid_sb_members. Simultaneously adjust the output mode of btree_bitmap_shift in member_to_text. Reported-and-tested-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=064ce437a1ad63d3f6ef Signed-off-by: Edward Adam Davis <[email protected]> --- fs/bcachefs/sb-members.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/bcachefs/sb-members.c b/fs/bcachefs/sb-members.c index 39196f2a4197..c9daab47f886 100644 --- a/fs/bcachefs/sb-members.c +++ b/fs/bcachefs/sb-members.c @@ -162,6 +162,12 @@ static int validate_member(struct printbuf *err, return -BCH_ERR_invalid_sb_members; } + if (m.btree_bitmap_shift >= 64) { + prt_printf(err, "device %u: too many big bitmap shift (got %u, max 64)", + i, m.btree_bitmap_shift); + return -BCH_ERR_invalid_sb_members; + } + return 0; } @@ -245,8 +251,7 @@ static void member_to_text(struct printbuf *out, prt_printf(out, "(none)"); prt_newline(out); - prt_printf(out, "Btree allocated bitmap blocksize:\t"); - prt_units_u64(out, 1ULL << m.btree_bitmap_shift); + prt_printf(out, "Btree allocated bitmap shift: %d\t", m.btree_bitmap_shift); prt_newline(out); prt_printf(out, "Btree allocated bitmap:\t"); -- 2.43.0
