[PATCH] bcache: validate sb->keys before computing checksum

csum_set() checksums the superblock from just past the csum field up to
&s->d[s->keys], so the length it hands to bch_crc64() comes straight off
disk. d[] only has SB_JOURNAL_BUCKETS (256) entries, but keys is __le16
and can be up to 65535, so a bogus value makes the crc walk far past the
end of the 4k superblock buffer.

syzbot hit this with a superblock that has a valid offset and
magic and garbage everywhere else:

BUG: KASAN: use-after-free in crc64_be_generic lib/crc/crc64-main.c:47 [inline]
BUG: KASAN: use-after-free in crc64_be+0xb8/0xe8 lib/crc/crc64-main.c:68
Read of size 1 at addr ffff0000dd543000 by task syz.0.33/4986
Call trace:
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 __asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378
 crc64_be_generic lib/crc/crc64-main.c:47 [inline]
 crc64_be+0xb8/0xe8 lib/crc/crc64-main.c:68
 bch_crc64 drivers/md/bcache/util.h:529 [inline]
 read_super drivers/md/bcache/super.c:208 [inline]

Add a bound check on sb->keys before calculating checksum.

Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=cb5b32abe226710cdd8a
Tested-by: [email protected]
Fixes: cafe56359144 ("bcache: A block layer cache")
Signed-off-by: Subasri S <[email protected]>
---
 drivers/md/bcache/super.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 97d9adb0bf96..71929576ab89 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -204,6 +204,10 @@ static const char *read_super(struct cache_sb *sb, struct block_device *bdev,
 	if (memcmp(sb->magic, bcache_magic, 16))
 		goto err;
 
+	err = "Too many journal buckets";
+	if (sb->keys > SB_JOURNAL_BUCKETS)
+		goto err;
+
 	err = "Bad checksum";
 	if (s->csum != csum_set(s))
 		goto err;

---
base-commit: 15ef2f78c49d20d53ec7c0f1c9b40b02e089f2d6
change-id: 20260815-bcache-super-5e48eebfc4ad

Best regards,
-- 
Subasri S <[email protected]>