bcachefs: Fix b->written overflow

When bset past end of btree node, we should not add sectors to
b->written, which will overflow b->written.

Reported-by: syzbot+3cb3d9e8c3f197754825@syzkaller.appspotmail.com
Tested-by: syzbot+3cb3d9e8c3f197754825@syzkaller.appspotmail.com
Signed-off-by: Alan Huang <mmpgouride@gmail.com>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>

diff --git a/fs/bcachefs/btree_io.c b/fs/bcachefs/btree_io.c
index dece27d9db04e8b81ed7c56f237d86bb369957c7..756736f9243d797eb4208772ff9a478241cad915 100644 (file)
--- a/fs/bcachefs/btree_io.c
+++ b/fs/bcachefs/btree_io.c
@@ -1186,7 +1186,7 @@ int bch2_btree_node_read_done(struct bch_fs *c, struct bch_dev *ca,
                             le64_to_cpu(i->journal_seq),
                             b->written, b->written + sectors, ptr_written);
 
-               b->written += sectors;
+               b->written = min(b->written + sectors, btree_sectors(c));
 
                if (blacklisted && !first)
                        continue;