On Mon, Sep 16, 2024 at 09:03:10PM GMT, Mohammed Anees wrote: > syzbot has found an general protection fault in prt_str [1]. > > In the prt_str function, a NULL pointer dereference occurs when the > parameter str is NULL, which is called in bch2_opt_to_text when > opt->type is BCH_OPT_STR. If an invalid index v or incorrect > flag is passed to ptr_str, then this could lead to this issue.
this fix looks wrong; if opt->choices[v] is NULL it's almost definitely because of a missing bounds check - I don't believe there are any string lists where we have gaps in the options. Can you add a proper bounds check? > > [1] https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5 > > Reported-and-tested-by: [email protected] > Closes: https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5 > Signed-off-by: Mohammed Anees <[email protected]> > --- > fs/bcachefs/opts.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c > index e10fc1da7..72b87251c 100644 > --- a/fs/bcachefs/opts.c > +++ b/fs/bcachefs/opts.c > @@ -420,8 +420,12 @@ void bch2_opt_to_text(struct printbuf *out, > case BCH_OPT_STR: > if (flags & OPT_SHOW_FULL_LIST) > prt_string_option(out, opt->choices, v); > - else > - prt_str(out, opt->choices[v]); > + else { > + if (opt->choices[v] == NULL) > + pr_err("Invalid flags or index v passed to the > function\n"); Also, don't use pr_err(); just do prt_printf(out, "(invalid option %u)", v); > + else > + prt_str(out, opt->choices[v]); > + } > break; > case BCH_OPT_FN: > opt->fn.to_text(out, c, sb, v); > -- > 2.46.0 >
