syzbot has found an general protection fault in prt_str [1]. In the prt_str function, a NULL pointer dereference occurs when the parameter str is NULL, which is called in bch2_opt_to_text when opt->type is BCH_OPT_STR. If an invalid index v or incorrect flag is passed to ptr_str, then this could lead to this issue.
[1] https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5 Reported-and-tested-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5 Signed-off-by: Mohammed Anees <[email protected]> --- fs/bcachefs/opts.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c index e10fc1da7..72b87251c 100644 --- a/fs/bcachefs/opts.c +++ b/fs/bcachefs/opts.c @@ -420,8 +420,12 @@ void bch2_opt_to_text(struct printbuf *out, case BCH_OPT_STR: if (flags & OPT_SHOW_FULL_LIST) prt_string_option(out, opt->choices, v); - else - prt_str(out, opt->choices[v]); + else { + if (opt->choices[v] == NULL) + pr_err("Invalid flags or index v passed to the function\n"); + else + prt_str(out, opt->choices[v]); + } break; case BCH_OPT_FN: opt->fn.to_text(out, c, sb, v); -- 2.46.0
