On Wed, Nov 06, 2024 at 07:46:30PM +0000, Piotr Zalewski wrote: > Change OPT_STR max value to be 1 less than the "ARRAY_SIZE" of "_choices" > array. As a result, remove -1 from (opt->max-1) in bch2_opt_to_text. > > The "_choices" array is a null-terminated array, so computing the maximum > using "ARRAY_SIZE" without subtracting 1 yields an incorrect result. Since > bch2_opt_validate don't subtract 1, as bch2_opt_to_text does, values > bigger than the actual maximum would pass through option validation. > > Reported-by: [email protected] > Closes: https://syzkaller.appspot.com/bug?extid=bee87a0c3291c06aa8c6 > Fixes: 63c4b2545382 ("bcachefs: Better superblock opt validation") > Suggested-by: Kent Overstreet <[email protected]> > Signed-off-by: Piotr Zalewski <[email protected]>
Thanks! Applied > --- > > Notes: > Changes in v2: > - Instead of subtracting 1 in bch2_opt_validate as in > bch2_opt_to_text add -1 in OPT_STR macro definition > and remove subtraction in bch2_opt_to_text. > > link to v1: > https://lore.kernel.org/linux-bcachefs/[email protected]/ > > fs/bcachefs/opts.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c > index 83f55cf99d46..49c59aec6954 100644 > --- a/fs/bcachefs/opts.c > +++ b/fs/bcachefs/opts.c > @@ -227,7 +227,7 @@ const struct bch_option bch2_opt_table[] = { > #define OPT_UINT(_min, _max) .type = BCH_OPT_UINT, \ > .min = _min, .max = _max > #define OPT_STR(_choices) .type = BCH_OPT_STR, \ > - .min = 0, .max = ARRAY_SIZE(_choices), \ > + .min = 0, .max = ARRAY_SIZE(_choices) - 1, \ > .choices = _choices > #define OPT_STR_NOLIMIT(_choices) .type = BCH_OPT_STR, \ > .min = 0, .max = U64_MAX, \ > @@ -429,7 +429,7 @@ void bch2_opt_to_text(struct printbuf *out, > prt_printf(out, "%lli", v); > break; > case BCH_OPT_STR: > - if (v < opt->min || v >= opt->max - 1) > + if (v < opt->min || v >= opt->max) > prt_printf(out, "(invalid option %lli)", v); > else if (flags & OPT_SHOW_FULL_LIST) > prt_string_option(out, opt->choices, v); > -- > 2.47.0 > >
