From: Mohammed Anees Date: Sat, 5 Oct 2024 13:02:29 +0000 (+0530) Subject: bcachefs: Fix NULL pointer dereference in bch2_opt_to_text X-Git-Tag: v6.12-rc4~44^2~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a30f32222df2a3777f8c09ef460ae8ad278021e6;p=thirdparty%2Flinux.git bcachefs: Fix NULL pointer dereference in bch2_opt_to_text This patch adds a bounds check to the bch2_opt_to_text function to prevent NULL pointer dereferences when accessing the opt->choices array. This ensures that the index used is within valid bounds before dereferencing. The new version enhances the readability. Reported-and-tested-by: syzbot+37186860aa7812b331d5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5 Signed-off-by: Mohammed Anees Signed-off-by: Kent Overstreet --- diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c index 232be8a44051f..84097235eea94 100644 --- a/fs/bcachefs/opts.c +++ b/fs/bcachefs/opts.c @@ -427,7 +427,9 @@ void bch2_opt_to_text(struct printbuf *out, prt_printf(out, "%lli", v); break; case BCH_OPT_STR: - if (flags & OPT_SHOW_FULL_LIST) + if (v < opt->min || v >= opt->max - 1) + prt_printf(out, "(invalid option %lli)", v); + else if (flags & OPT_SHOW_FULL_LIST) prt_string_option(out, opt->choices, v); else prt_str(out, opt->choices[v]);