In this patch, I added a proper bounds check to avoid a potential NULL pointer dereference when opt->choices[v] is accessed in the bch2_opt_to_text function. This ensures that v is within the valid range of choices.
Reported-and-tested-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5 Signed-off-by: Mohammed Anees <[email protected]> --- v2: - Replaced pr_err with prt_printf as suggested. - Added the bounds check on opt->choices before accessing it. fs/bcachefs/opts.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c index e10fc1da7..9bb15694d 100644 --- a/fs/bcachefs/opts.c +++ b/fs/bcachefs/opts.c @@ -420,8 +420,12 @@ void bch2_opt_to_text(struct printbuf *out, case BCH_OPT_STR: if (flags & OPT_SHOW_FULL_LIST) prt_string_option(out, opt->choices, v); - else - prt_str(out, opt->choices[v]); + else { + if (v < opt->min || v >= opt->max - 1) + prt_printf(out, "(invalid option %lli)", v); + else + prt_str(out, opt->choices[v]); + } break; case BCH_OPT_FN: opt->fn.to_text(out, c, sb, v); -- 2.46.0
