Re: Forwarded: [PATCH] check keys size before checksum calculation

[Coly Li]

> 2026年8月15日 15:43，syzbot <syzbot+cb5b32abe226710cdd8a@xxxxxxxxxxxxxxxxxxxxxxxxx> 写道：
> 
> For archival purposes, forwarding an incoming command email to
> linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.
> 
> ***
> 
> Subject: [PATCH] check keys size before checksum calculation
> Author: subasris1210@xxxxxxxxx
> 
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git ba5cc80fd32665ed609037ff30ede8d194f24aab
> 
> Signed-off-by: Subasri S <subasris1210@xxxxxxxxx>

The above content seems not like a formal commit log? It is too simple, no explicit clue and
connection to the following change.

> ---
> drivers/md/bcache/super.c | 5 +++++
> 1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
> index 97d9adb0bf96..49b3a2231820 100644
> --- a/drivers/md/bcache/super.c
> +++ b/drivers/md/bcache/super.c
> @@ -204,6 +204,11 @@ static const char *read_super(struct cache_sb *sb, struct block_device *bdev,
> if (memcmp(sb->magic, bcache_magic, 16))
> goto err;
> 
> +
> + err = "Too many journal buckets";
> + if (sb->keys > SB_JOURNAL_BUCKETS)
> + goto err;
> +
> err = "Bad checksum";
> if (s->csum != csum_set(s))
> goto err;


Normally if bcache works correctly, the journal blocks record will always be correct. How do you trigger
this condition to happen? If it is from a corrupt super block, this check doesn’t make sense, because the
next one is to verify the checksum, checking super block members before verifying its checksum doesn’t
help IMHO.

Or any information that I missed?

Thanks.

Coly Li