linux-kernel - Re: [PATCH] bcachefs: Fix NULL pointer dereference in bch2_opt_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <vhgla2z2s2mlsjiniqs6no5d6p7ksq5ipgogd2covx3wejeys7@ha32mumxipi3>
Date: Sat, 21 Sep 2024 14:52:21 -0400
From: Kent Overstreet <kent.overstreet@...ux.dev>
To: Mohammed Anees <pvmohammedanees2003@...il.com>
Cc: linux-bcachefs@...r.kernel.org, linux-kernel@...r.kernel.org, 
	syzbot+37186860aa7812b331d5@...kaller.appspotmail.com
Subject: Re: [PATCH] bcachefs: Fix NULL pointer dereference in
 bch2_opt_to_text

On Mon, Sep 16, 2024 at 09:03:10PM GMT, Mohammed Anees wrote:
> syzbot has found an general protection fault in prt_str [1].
> 
> In the prt_str function, a NULL pointer dereference occurs when the
> parameter str is NULL, which is called in bch2_opt_to_text when
> opt->type is BCH_OPT_STR. If an invalid index v or incorrect
> flag is passed to ptr_str, then this could lead to this issue.

this fix looks wrong; if opt->choices[v] is NULL it's almost definitely
because of a missing bounds check - I don't believe there are any string
lists where we have gaps in the options.

Can you add a proper bounds check?

> 
> [1] https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5
> 
> Reported-and-tested-by: syzbot+37186860aa7812b331d5@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5
> Signed-off-by: Mohammed Anees <pvmohammedanees2003@...il.com>
> ---
>  fs/bcachefs/opts.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c
> index e10fc1da7..72b87251c 100644
> --- a/fs/bcachefs/opts.c
> +++ b/fs/bcachefs/opts.c
> @@ -420,8 +420,12 @@ void bch2_opt_to_text(struct printbuf *out,
>  	case BCH_OPT_STR:
>  		if (flags & OPT_SHOW_FULL_LIST)
>  			prt_string_option(out, opt->choices, v);
> -		else
> -			prt_str(out, opt->choices[v]);
> +		else {
> +			if (opt->choices[v] == NULL)
> +				pr_err("Invalid flags or index v passed to the function\n");

Also, don't use pr_err(); just do prt_printf(out, "(invalid option %u)", v);

> +			else
> +				prt_str(out, opt->choices[v]);
> +		}
>  		break;
>  	case BCH_OPT_FN:
>  		opt->fn.to_text(out, c, sb, v);
> -- 
> 2.46.0
>