[PATCH RESEND] bcache: validate sb->keys before computing checksum

[PATCH RESEND] bcache: validate sb->keys before computing checksum

[Subasri S]

csum_set() checksums the superblock from just past the csum field up to
&s->d[s->keys], so the length it hands to bch_crc64() comes straight off
disk. d[] only has SB_JOURNAL_BUCKETS (256) entries, but keys is __le16
and can be up to 65535, so a bogus value makes the crc walk far past the
end of the 4k superblock buffer.

syzbot hit this with a superblock that has a valid offset and
magic and garbage everywhere else:

BUG: KASAN: use-after-free in crc64_be_generic lib/crc/crc64-main.c:47 [inline]
BUG: KASAN: use-after-free in crc64_be+0xb8/0xe8 lib/crc/crc64-main.c:68
Read of size 1 at addr ffff0000dd543000 by task syz.0.33/4986
Call trace:
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 __asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378
 crc64_be_generic lib/crc/crc64-main.c:47 [inline]
 crc64_be+0xb8/0xe8 lib/crc/crc64-main.c:68
 bch_crc64 drivers/md/bcache/util.h:529 [inline]
 read_super drivers/md/bcache/super.c:208 [inline]

Add a bound check on sb->keys before calculating checksum.

Reported-by: syzbot+cb5b32abe226710cdd8a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cb5b32abe226710cdd8a
Tested-by: syzbot+cb5b32abe226710cdd8a@syzkaller.appspotmail.com
Fixes: cafe56359144 ("bcache: A block layer cache")
Signed-off-by: Subasri S <subasris1210@gmail.com>
---
 drivers/md/bcache/super.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 97d9adb0bf96b..71929576ab89e 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -204,6 +204,10 @@ static const char *read_super(struct cache_sb *sb, struct block_device *bdev,
 	if (memcmp(sb->magic, bcache_magic, 16))
 		goto err;
 
+	err = "Too many journal buckets";
+	if (sb->keys > SB_JOURNAL_BUCKETS)
+		goto err;
+
 	err = "Bad checksum";
 	if (s->csum != csum_set(s))
 		goto err;

---
base-commit: 15ef2f78c49d20d53ec7c0f1c9b40b02e089f2d6
change-id: 20260815-bcache-super-5e48eebfc4ad

Best regards,
-- 
Subasri S <subasris1210@gmail.com>

Re: [PATCH RESEND] bcache: validate sb->keys before computing checksum

[Coly Li]

Hi Subasri,

> 2026年10月13日 10:09，Subasri S <subasris1210@gmail.com> 写道：
> 
> csum_set() checksums the superblock from just past the csum field up to
> &s->d[s->keys], so the length it hands to bch_crc64() comes straight off
> disk. d[] only has SB_JOURNAL_BUCKETS (256) entries, but keys is __le16
> and can be up to 65535, so a bogus value makes the crc walk far past the
> end of the 4k superblock buffer.

How can a bogus sb->keys value walk through the checksum?

> 
> syzbot hit this with a superblock that has a valid offset and
> magic and garbage everywhere else:
> 
> BUG: KASAN: use-after-free in crc64_be_generic lib/crc/crc64-main.c:47 [inline]
> BUG: KASAN: use-after-free in crc64_be+0xb8/0xe8 lib/crc/crc64-main.c:68
> Read of size 1 at addr ffff0000dd543000 by task syz.0.33/4986
> Call trace:
> kasan_report+0x8c/0xc4 mm/kasan/report.c:595
> __asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378
> crc64_be_generic lib/crc/crc64-main.c:47 [inline]
> crc64_be+0xb8/0xe8 lib/crc/crc64-main.c:68
> bch_crc64 drivers/md/bcache/util.h:529 [inline]
> read_super drivers/md/bcache/super.c:208 [inline]
> 

I doubt whether the above warning is valid, where the use-after-free condition?


> Add a bound check on sb->keys before calculating checksum.
> 
> Reported-by: syzbot+cb5b32abe226710cdd8a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=cb5b32abe226710cdd8a
> Tested-by: syzbot+cb5b32abe226710cdd8a@syzkaller.appspotmail.com
> Fixes: cafe56359144 ("bcache: A block layer cache")
> Signed-off-by: Subasri S <subasris1210@gmail.com>
> ---
> drivers/md/bcache/super.c | 4 ++++
> 1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
> index 97d9adb0bf96b..71929576ab89e 100644
> --- a/drivers/md/bcache/super.c
> +++ b/drivers/md/bcache/super.c
> @@ -204,6 +204,10 @@ static const char *read_super(struct cache_sb *sb, struct block_device *bdev,
> if (memcmp(sb->magic, bcache_magic, 16))
> goto err;
> 
> + err = "Too many journal buckets";
> + if (sb->keys > SB_JOURNAL_BUCKETS)
> + goto err;
> +
> err = "Bad checksum";
> if (s->csum != csum_set(s))
> goto err;
> 


Other bogus field can also goes through a on-purpose built checksum.

Thanks.

Coly Li


> ---
> base-commit: 15ef2f78c49d20d53ec7c0f1c9b40b02e089f2d6
> change-id: 20260815-bcache-super-5e48eebfc4ad
> 
> Best regards,
> -- 
> Subasri S <subasris1210@gmail.com>
>