[v1] bcachefs: Fix NULL pointer dereference in bch2_opt_to_text

[PATCH] bcachefs: Fix NULL pointer dereference in bch2_opt_to_text

Posted by Mohammed Anees 2 months, 1 week ago

syzbot has found an general protection fault in prt_str [1].

In the prt_str function, a NULL pointer dereference occurs when the
parameter str is NULL, which is called in bch2_opt_to_text when
opt->type is BCH_OPT_STR. If an invalid index v or incorrect
flag is passed to ptr_str, then this could lead to this issue.

[1] https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5

Reported-and-tested-by: syzbot+37186860aa7812b331d5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5
Signed-off-by: Mohammed Anees <pvmohammedanees2003@gmail.com>
---
 fs/bcachefs/opts.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c
index e10fc1da7..72b87251c 100644
--- a/fs/bcachefs/opts.c
+++ b/fs/bcachefs/opts.c
@@ -420,8 +420,12 @@ void bch2_opt_to_text(struct printbuf *out,
 	case BCH_OPT_STR:
 		if (flags & OPT_SHOW_FULL_LIST)
 			prt_string_option(out, opt->choices, v);
-		else
-			prt_str(out, opt->choices[v]);
+		else {
+			if (opt->choices[v] == NULL)
+				pr_err("Invalid flags or index v passed to the function\n");
+			else
+				prt_str(out, opt->choices[v]);
+		}
 		break;
 	case BCH_OPT_FN:
 		opt->fn.to_text(out, c, sb, v);
-- 
2.46.0

Re: [PATCH] bcachefs: Fix NULL pointer dereference in bch2_opt_to_text

Posted by Kent Overstreet 2 months, 1 week ago

On Mon, Sep 16, 2024 at 09:03:10PM GMT, Mohammed Anees wrote:
> syzbot has found an general protection fault in prt_str [1].
> 
> In the prt_str function, a NULL pointer dereference occurs when the
> parameter str is NULL, which is called in bch2_opt_to_text when
> opt->type is BCH_OPT_STR. If an invalid index v or incorrect
> flag is passed to ptr_str, then this could lead to this issue.

this fix looks wrong; if opt->choices[v] is NULL it's almost definitely
because of a missing bounds check - I don't believe there are any string
lists where we have gaps in the options.

Can you add a proper bounds check?

> 
> [1] https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5
> 
> Reported-and-tested-by: syzbot+37186860aa7812b331d5@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5
> Signed-off-by: Mohammed Anees <pvmohammedanees2003@gmail.com>
> ---
>  fs/bcachefs/opts.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c
> index e10fc1da7..72b87251c 100644
> --- a/fs/bcachefs/opts.c
> +++ b/fs/bcachefs/opts.c
> @@ -420,8 +420,12 @@ void bch2_opt_to_text(struct printbuf *out,
>  	case BCH_OPT_STR:
>  		if (flags & OPT_SHOW_FULL_LIST)
>  			prt_string_option(out, opt->choices, v);
> -		else
> -			prt_str(out, opt->choices[v]);
> +		else {
> +			if (opt->choices[v] == NULL)
> +				pr_err("Invalid flags or index v passed to the function\n");

Also, don't use pr_err(); just do prt_printf(out, "(invalid option %u)", v);

> +			else
> +				prt_str(out, opt->choices[v]);
> +		}
>  		break;
>  	case BCH_OPT_FN:
>  		opt->fn.to_text(out, c, sb, v);
> -- 
> 2.46.0
>