bcachefs: Check for backpointer bucket_offset >= bucket size

Signed-off-by: Kent Overstreet <[email protected]>

fs/bcachefs/backpointers.c

@@ -49,13 +49,15 @@ int bch2_backpointer_invalid(struct bch_fs *c, struct bkey_s_c k,
  if (!bch2_dev_exists2(c, bp.k->p.inode))
  return 0;
 
+ struct bch_dev *ca = bch_dev_bkey_exists(c, bp.k->p.inode);
  struct bpos bucket = bp_pos_to_bucket(c, bp.k->p);
  int ret = 0;
 
- bkey_fsck_err_on(!bpos_eq(bp.k->p, bucket_pos_to_bp(c, bucket, bp.v->bucket_offset)),
+ bkey_fsck_err_on((bp.v->bucket_offset >> MAX_EXTENT_COMPRESS_RATIO_SHIFT) >= ca->mi.bucket_size ||
+ !bpos_eq(bp.k->p, bucket_pos_to_bp(c, bucket, bp.v->bucket_offset)),
  c, err,
- backpointer_pos_wrong,
- "backpointer at wrong pos");
+ backpointer_bucket_offset_wrong,
+ "backpointer bucket_offset wrong");
 fsck_err:
  return ret;
 }

fs/bcachefs/backpointers.h

@@ -53,14 +53,11 @@ static inline struct bpos bucket_pos_to_bp(const struct bch_fs *c,
  u64 bucket_offset)
 {
  struct bch_dev *ca = bch_dev_bkey_exists(c, bucket.inode);
- struct bpos ret;
-
- ret = POS(bucket.inode,
- (bucket_to_sector(ca, bucket.offset) <<
- MAX_EXTENT_COMPRESS_RATIO_SHIFT) + bucket_offset);
+ struct bpos ret = POS(bucket.inode,
+ (bucket_to_sector(ca, bucket.offset) <<
+ MAX_EXTENT_COMPRESS_RATIO_SHIFT) + bucket_offset);
 
  EBUG_ON(!bkey_eq(bucket, bp_pos_to_bucket(c, ret)));
-
  return ret;
 }
 

fs/bcachefs/sb-errors_types.h

@@ -130,7 +130,7 @@
  x(bucket_gens_nonzero_for_invalid_buckets, 122) \
  x(need_discard_freespace_key_to_invalid_dev_bucket, 123) \
  x(need_discard_freespace_key_bad, 124) \
- x(backpointer_pos_wrong,  125) \
+ x(backpointer_bucket_offset_wrong, 125) \
  x(backpointer_to_missing_device, 126) \
  x(backpointer_to_missing_alloc, 127) \
  x(backpointer_to_missing_ptr, 128) \