omfs_fill_super() prints the root-block volume label with %s.  The label is
the on-disk omfs_root_block::r_name field, a fixed OMFS_NAMELEN byte array
that need not contain a terminating NUL byte.

A crafted image can place a non-terminated label at the end of the root
block buffer.  The formatter then scans past the label while mounting the
image, and KASAN reports an out-of-bounds read from the formatting path.

Print the label with a precision capped at OMFS_NAMELEN.  This keeps
formatting from reading beyond the on-disk array.

Signed-off-by: David Lee <david.lee@trailofbits.com>
Assisted-by: Codex:gpt-5.5
---
Trail of Bits has a reproducer for this bug demonstrating Kernel Panic which can be shared further if needed.

 fs/omfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
index 1d915ef72119..ea51c1bc3eee 100644
--- a/fs/omfs/inode.c
+++ b/fs/omfs/inode.c
@@ -590,7 +590,7 @@ static int omfs_fill_super(struct super_block *sb, struct fs_context *fc)
 		ret = -ENOMEM;
 		goto out_brelse_bh2;
 	}
-	printk(KERN_DEBUG "omfs: Mounted volume %s\n", omfs_rb->r_name);
+	pr_debug("Mounted volume %.*s\n", OMFS_NAMELEN, omfs_rb->r_name);
 
 	ret = 0;
 out_brelse_bh2:
-- 
2.43.0