[PATCH] bcachefs: fix divide by zero error in util.c

[PATCH] bcachefs: fix divide by zero error in util.c

[Dennis Lam]

This patch aims to fix a bug found by syzbot where a crash occurs due to
a divide by zero error in the bcachefs subsystem [1].

Bcachefs has a file called util.c that uses the function div_u64 to perform
division using 64-bit values. The function's parameters uses a 64-bit dividend
and a 32-bit divisor to perform its division, however sometimes in this file
a 64-bit divisor is passed using this function. When in use, the 64-bit value
is passed as a 32-bit value, creating the possibility of a division by zero error.

Therefore, this fix replaces the function div_u64 with div64_u64 where the
dividend and divisor is a 64-bit value to perform the correct division.

[1] https://syzkaller.appspot.com/bug?extid=24beef64217854da05a4

Reported-and-tested-by: syzbot+24beef64217854da05a4@syzkaller.appspotmail.com
Signed-off-by: Dennis Lam <dennis.lamerice@gmail.com>
---
 fs/bcachefs/util.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/fs/bcachefs/util.c b/fs/bcachefs/util.c
index 1b8554460af4..cea162b99864 100644
--- a/fs/bcachefs/util.c
+++ b/fs/bcachefs/util.c
@@ -64,7 +64,7 @@ static int bch2_pow(u64 n, u64 p, u64 *res)
 	*res = 1;
 
 	while (p--) {
-		if (*res > div_u64(U64_MAX, n))
+		if (*res > div64_u64(U64_MAX, n))
 			return -ERANGE;
 		*res *= n;
 	}
@@ -140,14 +140,14 @@ static int __bch2_strtou64_h(const char *cp, u64 *res)
 
 	parse_or_ret(cp, parse_unit_suffix(cp, &b));
 
-	if (v > div_u64(U64_MAX, b))
+	if (v > div64_u64(U64_MAX, b))
 		return -ERANGE;
 	v *= b;
 
-	if (f_n > div_u64(U64_MAX, b))
+	if (f_n > div64_u64(U64_MAX, b))
 		return -ERANGE;
 
-	f_n = div_u64(f_n * b, f_d);
+	f_n = div64_u64(f_n * b, f_d);
 	if (v + f_n < v)
 		return -ERANGE;
 	v += f_n;
@@ -360,7 +360,7 @@ void bch2_pr_time_units(struct printbuf *out, u64 ns)
 {
 	const struct time_unit *u = bch2_pick_time_units(ns);
 
-	prt_printf(out, "%llu %s", div_u64(ns, u->nsecs), u->name);
+	prt_printf(out, "%llu %s", div64_u64(ns, u->nsecs), u->name);
 }
 
 static void bch2_pr_time_units_aligned(struct printbuf *out, u64 ns)
@@ -477,7 +477,7 @@ void bch2_time_stats_to_text(struct printbuf *out, struct bch2_time_stats *stats
 			bool is_last = eytzinger0_next(i, NR_QUANTILES) == -1;
 
 			u64 q = max(quantiles->entries[i].m, last_q);
-			prt_printf(out, "%llu ", div_u64(q, u->nsecs));
+			prt_printf(out, "%llu ", div64_u64(q, u->nsecs));
 			if (is_last)
 				prt_newline(out);
 			last_q = q;
@@ -511,7 +511,7 @@ void bch2_ratelimit_increment(struct bch_ratelimit *d, u64 done)
 {
 	u64 now = local_clock();
 
-	d->next += div_u64(done * NSEC_PER_SEC, d->rate);
+	d->next += div64_u64(done * NSEC_PER_SEC, d->rate);
 
 	if (time_before64(now + NSEC_PER_SEC, d->next))
 		d->next = now + NSEC_PER_SEC;
-- 
2.46.1

Re: [PATCH] bcachefs: fix divide by zero error in util.c

[Kent Overstreet]

On Sun, Sep 22, 2024 at 07:33:44PM GMT, Dennis Lam wrote:
> This patch aims to fix a bug found by syzbot where a crash occurs due to
> a divide by zero error in the bcachefs subsystem [1].
> 
> Bcachefs has a file called util.c that uses the function div_u64 to perform
> division using 64-bit values. The function's parameters uses a 64-bit dividend
> and a 32-bit divisor to perform its division, however sometimes in this file
> a 64-bit divisor is passed using this function. When in use, the 64-bit value
> is passed as a 32-bit value, creating the possibility of a division by zero error.
> 
> Therefore, this fix replaces the function div_u64 with div64_u64 where the
> dividend and divisor is a 64-bit value to perform the correct division.
> 
> [1] https://syzkaller.appspot.com/bug?extid=24beef64217854da05a4
> 
> Reported-and-tested-by: syzbot+24beef64217854da05a4@syzkaller.appspotmail.com
> Signed-off-by: Dennis Lam <dennis.lamerice@gmail.com>

We already have this, from Reed Riley

27663d7784b5 bcachefs: Replace div_u64 with div64_u64 where second param is u64