This patch adds a bounds check to the bch2_opt_to_text function to prevent NULL pointer dereferences when accessing the opt->choices array. This ensures that the index used is within valid bounds before dereferencing. The new version enhances the readability.
Reported-and-tested-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5 Signed-off-by: Mohammed Anees <[email protected]> --- v3: - Moved bounds check above as default case. - Removed the nested if clauses. fs/bcachefs/opts.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletions(-) diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c index e10fc1da7..1d777b332 100644 --- a/fs/bcachefs/opts.c +++ b/fs/bcachefs/opts.c @@ -418,7 +418,9 @@ void bch2_opt_to_text(struct printbuf *out, prt_printf(out, "%lli", v); break; case BCH_OPT_STR: - if (flags & OPT_SHOW_FULL_LIST) + if (v < opt->min || v >= opt->max - 1) + prt_printf(out, "(invalid option %lli)", v); + else if (flags & OPT_SHOW_FULL_LIST) prt_string_option(out, opt->choices, v); else prt_str(out, opt->choices[v]); 2.46.0
