[PATCH 6.12] bcachefs: Drop swab code for backpointers in alloc keys

From: Mikhail Dmitrichenko

Date: Fri Oct 23 2026 - 10:49:33 EST


From: Kent Overstreet <kent.overstreet@xxxxxxxxx>

commit abff9b149dcc0a584cbadc869167e5a7199cd1ce upstream.

Signed-off-by: Kent Overstreet <kent.overstreet@xxxxxxxxx>
Signed-off-by: Mikhail Dmitrichenko <mdmitrichenko@xxxxxxxxxxxxx>
---
The upstream commit has no description, so some context for stable:
bch2_alloc_v4_swab() is called from bch2_bkey_compat() before
bset_key_validate() when reading a btree node written with the other
endianness, so the backpointers start and count it uses come straight
from disk. With bogus values the loop byte-swaps memory past the end of
the key value, possibly past the end of the node buffer.

Backpointers stored in alloc keys are not used anymore,
__bch2_alloc_to_v4() and bch2_alloc_to_v4_mut() drop them anyway, so
removing the loop is safe.

fs/bcachefs/alloc_background.c | 8 --------
1 file changed, 8 deletions(-)

diff --git a/fs/bcachefs/alloc_background.c b/fs/bcachefs/alloc_background.c
index c84a91572a1d..402f20eadae2 100644
--- a/fs/bcachefs/alloc_background.c
+++ b/fs/bcachefs/alloc_background.c
@@ -322,7 +322,6 @@ int bch2_alloc_v4_validate(struct bch_fs *c, struct bkey_s_c k,
void bch2_alloc_v4_swab(struct bkey_s k)
{
struct bch_alloc_v4 *a = bkey_s_to_alloc_v4(k).v;
- struct bch_backpointer *bp, *bps;

a->journal_seq = swab64(a->journal_seq);
a->flags = swab32(a->flags);
@@ -333,13 +332,6 @@ void bch2_alloc_v4_swab(struct bkey_s k)
a->stripe = swab32(a->stripe);
a->nr_external_backpointers = swab32(a->nr_external_backpointers);
a->stripe_sectors = swab32(a->stripe_sectors);
-
- bps = alloc_v4_backpointers(a);
- for (bp = bps; bp < bps + BCH_ALLOC_V4_NR_BACKPOINTERS(a); bp++) {
- bp->bucket_offset = swab40(bp->bucket_offset);
- bp->bucket_len = swab32(bp->bucket_len);
- bch2_bpos_swab(&bp->pos);
- }
}

void bch2_alloc_to_text(struct printbuf *out, struct bch_fs *c, struct bkey_s_c k)
--
2.43.0