1. Patchew
  2. linux
  3. View series

[PATCH v2] Change OPT_STR max to be 1 less than the size of choices array

Piotr Zalewski posted 1 patch 2 weeks, 3 days ago 
fs/bcachefs/opts.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
[PATCH v2] Change OPT_STR max to be 1 less than the size of choices array
Posted by Piotr Zalewski 2 weeks, 3 days ago 
Change OPT_STR max value to be 1 less than the "ARRAY_SIZE" of "_choices"
array. As a result, remove -1 from (opt->max-1) in bch2_opt_to_text.

The "_choices" array is a null-terminated array, so computing the maximum
using "ARRAY_SIZE" without subtracting 1 yields an incorrect result. Since
bch2_opt_validate don't subtract 1, as bch2_opt_to_text does, values
bigger than the actual maximum would pass through option validation.

Reported-by: syzbot+bee87a0c3291c06aa8c6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bee87a0c3291c06aa8c6
Fixes: 63c4b2545382 ("bcachefs: Better superblock opt validation")
Suggested-by: Kent Overstreet <kent.overstreet@linux.dev>
Signed-off-by: Piotr Zalewski <pZ010001011111@proton.me>
---

Notes:
    Changes in v2:
        - Instead of subtracting 1 in bch2_opt_validate as in
          bch2_opt_to_text add -1 in OPT_STR macro definition
          and remove subtraction in bch2_opt_to_text.

    link to v1: https://lore.kernel.org/linux-bcachefs/20241031231823.688918-2-pZ010001011111@proton.me/

 fs/bcachefs/opts.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c
index 83f55cf99d46..49c59aec6954 100644
--- a/fs/bcachefs/opts.c
+++ b/fs/bcachefs/opts.c
@@ -227,7 +227,7 @@ const struct bch_option bch2_opt_table[] = {
 #define OPT_UINT(_min, _max)	.type = BCH_OPT_UINT,			\
 				.min = _min, .max = _max
 #define OPT_STR(_choices)	.type = BCH_OPT_STR,			\
-				.min = 0, .max = ARRAY_SIZE(_choices),	\
+				.min = 0, .max = ARRAY_SIZE(_choices) - 1, \
 				.choices = _choices
 #define OPT_STR_NOLIMIT(_choices)	.type = BCH_OPT_STR,		\
 				.min = 0, .max = U64_MAX,		\
@@ -429,7 +429,7 @@ void bch2_opt_to_text(struct printbuf *out,
 			prt_printf(out, "%lli", v);
 		break;
 	case BCH_OPT_STR:
-		if (v < opt->min || v >= opt->max - 1)
+		if (v < opt->min || v >= opt->max)
 			prt_printf(out, "(invalid option %lli)", v);
 		else if (flags & OPT_SHOW_FULL_LIST)
 			prt_string_option(out, opt->choices, v);
-- 
2.47.0
Re: [PATCH v2] Change OPT_STR max to be 1 less than the size of choices array
Posted by Kent Overstreet 2 weeks, 3 days ago 
On Wed, Nov 06, 2024 at 07:46:30PM +0000, Piotr Zalewski wrote:
> Change OPT_STR max value to be 1 less than the "ARRAY_SIZE" of "_choices"
> array. As a result, remove -1 from (opt->max-1) in bch2_opt_to_text.
> 
> The "_choices" array is a null-terminated array, so computing the maximum
> using "ARRAY_SIZE" without subtracting 1 yields an incorrect result. Since
> bch2_opt_validate don't subtract 1, as bch2_opt_to_text does, values
> bigger than the actual maximum would pass through option validation.
> 
> Reported-by: syzbot+bee87a0c3291c06aa8c6@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=bee87a0c3291c06aa8c6
> Fixes: 63c4b2545382 ("bcachefs: Better superblock opt validation")
> Suggested-by: Kent Overstreet <kent.overstreet@linux.dev>
> Signed-off-by: Piotr Zalewski <pZ010001011111@proton.me>

Thanks! Applied

> ---
> 
> Notes:
>     Changes in v2:
>         - Instead of subtracting 1 in bch2_opt_validate as in
>           bch2_opt_to_text add -1 in OPT_STR macro definition
>           and remove subtraction in bch2_opt_to_text.
> 
>     link to v1: https://lore.kernel.org/linux-bcachefs/20241031231823.688918-2-pZ010001011111@proton.me/
> 
>  fs/bcachefs/opts.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c
> index 83f55cf99d46..49c59aec6954 100644
> --- a/fs/bcachefs/opts.c
> +++ b/fs/bcachefs/opts.c
> @@ -227,7 +227,7 @@ const struct bch_option bch2_opt_table[] = {
>  #define OPT_UINT(_min, _max)	.type = BCH_OPT_UINT,			\
>  				.min = _min, .max = _max
>  #define OPT_STR(_choices)	.type = BCH_OPT_STR,			\
> -				.min = 0, .max = ARRAY_SIZE(_choices),	\
> +				.min = 0, .max = ARRAY_SIZE(_choices) - 1, \
>  				.choices = _choices
>  #define OPT_STR_NOLIMIT(_choices)	.type = BCH_OPT_STR,		\
>  				.min = 0, .max = U64_MAX,		\
> @@ -429,7 +429,7 @@ void bch2_opt_to_text(struct printbuf *out,
>  			prt_printf(out, "%lli", v);
>  		break;
>  	case BCH_OPT_STR:
> -		if (v < opt->min || v >= opt->max - 1)
> +		if (v < opt->min || v >= opt->max)
>  			prt_printf(out, "(invalid option %lli)", v);
>  		else if (flags & OPT_SHOW_FULL_LIST)
>  			prt_string_option(out, opt->choices, v);
> -- 
> 2.47.0
> 
>

Patchew 2.1-devel-b67e4c2

© 2016 - 2024 Red Hat, Inc.