Re: [PATCH] bcache: fix variable length array abuse in btree_iter

[Coly Li <colyli@suse.de>]

> 2024年3月15日 08:21，Matthew Mirvish <matthew@mm12.xyz> 写道：
> 
> btree_iter is used in two ways: either allocated on the stack with a
> fixed size MAX_BSETS, or from a mempool with a dynamic size based on the
> specific cache set. Previously, the struct had a fixed-length array of
> size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized
> iterators, which causes UBSAN to complain.
> 
> This patch uses the same approach as in bcachefs's sort_iter and splits
> the iterator into a btree_iter with a flexible array member and a
> btree_iter_stack which embeds a btree_iter as well as a fixed-length
> data array.
> 
> Cc: stable@vger.kernel.org
> Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039368
> Signed-off-by: Matthew Mirvish <matthew@mm12.xyz>

This patch is overall good to me.
Let me take it and test for a while, and submit it to next merge window if the testing goes well.

Thanks.

Coly Li

> ---
> drivers/md/bcache/bset.c      | 44 +++++++++++++++++------------------
> drivers/md/bcache/bset.h      | 28 ++++++++++++++--------
> drivers/md/bcache/btree.c     | 40 ++++++++++++++++---------------
> drivers/md/bcache/super.c     |  5 ++--
> drivers/md/bcache/sysfs.c     |  2 +-
> drivers/md/bcache/writeback.c | 10 ++++----
> 6 files changed, 70 insertions(+), 59 deletions(-)
> 

[snipped]