[PATCH resend v3] bcachefs: Fix NULL pointer dereference in bch2_opt_to_text

[PATCH resend v3] bcachefs: Fix NULL pointer dereference in bch2_opt_to_text

[Mohammed Anees]

This patch adds a bounds check to the bch2_opt_to_text function to prevent
NULL pointer dereferences when accessing the opt->choices array. This
ensures that the index used is within valid bounds before dereferencing.
The new version enhances the readability.

Reported-and-tested-by: syzbot+37186860aa7812b331d5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5
Signed-off-by: Mohammed Anees <pvmohammedanees2003@gmail.com>
---
v3:
- Moved bounds check above as default case.
- Removed the nesterd if clauses.
---
 fs/bcachefs/opts.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c
index 232be8a44051..84097235eea9 100644
--- a/fs/bcachefs/opts.c
+++ b/fs/bcachefs/opts.c
@@ -427,7 +427,9 @@ void bch2_opt_to_text(struct printbuf *out,
 			prt_printf(out, "%lli", v);
 		break;
 	case BCH_OPT_STR:
-		if (flags & OPT_SHOW_FULL_LIST)
+		if (v < opt->min || v >= opt->max - 1)
+			prt_printf(out, "(invalid option %lli)", v);
+		else if (flags & OPT_SHOW_FULL_LIST)
 			prt_string_option(out, opt->choices, v);
 		else
 			prt_str(out, opt->choices[v]);
-- 
2.46.0

Re: [PATCH resend v3] bcachefs: Fix NULL pointer dereference in bch2_opt_to_text

[Hongbo Li]

On 2024/10/5 21:02, Mohammed Anees wrote:
> This patch adds a bounds check to the bch2_opt_to_text function to prevent
> NULL pointer dereferences when accessing the opt->choices array. This
> ensures that the index used is within valid bounds before dereferencing.
> The new version enhances the readability.
> 
> Reported-and-tested-by: syzbot+37186860aa7812b331d5@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5
> Signed-off-by: Mohammed Anees <pvmohammedanees2003@gmail.com>
> ---
> v3:
> - Moved bounds check above as default case.
> - Removed the nesterd if clauses.
> ---
>   fs/bcachefs/opts.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c
> index 232be8a44051..84097235eea9 100644
> --- a/fs/bcachefs/opts.c
> +++ b/fs/bcachefs/opts.c
> @@ -427,7 +427,9 @@ void bch2_opt_to_text(struct printbuf *out,
>   			prt_printf(out, "%lli", v);
>   		break;
>   	case BCH_OPT_STR:
> -		if (flags & OPT_SHOW_FULL_LIST)
> +		if (v < opt->min || v >= opt->max - 1)
As definition, max is the right bound for value. opt->max - 1 is valid. 
May be you should remove the equals sign.

It should be no problem to just solve this null pointer issue() (How is 
this stack triggered, may be I lost something.), but this should be a 
general boundary check condition, strictly speaking, it's a check for 
the validity of the options' value.

Thanks,
Hongbo

> +			prt_printf(out, "(invalid option %lli)", v);
> +		else if (flags & OPT_SHOW_FULL_LIST)
>   			prt_string_option(out, opt->choices, v);
>   		else
>   			prt_str(out, opt->choices[v]);

Re: [PATCH resend v3] bcachefs: Fix NULL pointer dereference in bch2_opt_to_text

[Mohammed Anees]

Hi Hongbo,

> As definition, max is the right bound for value. opt->max - 1 is valid. 
> May be you should remove the equals sign.

This is not true, max is not the right upper bound when it comes to
this but rather the size of the array instead, therefore opt->max - 1
is where we should stop.

const struct bch_option bch2_opt_table[] = {
#define OPT_BOOL()		.type = BCH_OPT_BOOL, .min = 0, .max = 2
#define OPT_UINT(_min, _max)	.type = BCH_OPT_UINT,			\
				.min = _min, .max = _max
#define OPT_STR(_choices)	.type = BCH_OPT_STR,			\
				.min = 0, .max = ARRAY_SIZE(_choices),	\
				.choices = _choices
...

Here if you look at OPT_STR you see that it is indeed the size
of the array.

> It should be no problem to just solve this null pointer issue() (How is 
> this stack triggered, may be I lost something.), but this should be a 

The reason this is triggered is because in bch2_opt_to_text,
the parameter v passed is beyond the number of options available 
to Opt_str_hash.

#define BCH_STR_HASH_OPTS()		\
	x(crc32c,		0)	\
	x(crc64,		1)	\
	x(siphash,		2)

Passing a value v of 3 attempts to access a non-existent fourth element.
This value v corresponds to str_hash in the bch_opts structure within the 
bch_fs struct. Since print_mount_opts checks each option, it seems 
appropriate to add the validation there. Please let me know if 
I've misunderstood anything.

Thanks!

Re: [PATCH resend v3] bcachefs: Fix NULL pointer dereference in bch2_opt_to_text

[Kent Overstreet]

On Sat, Oct 05, 2024 at 06:32:29PM GMT, Mohammed Anees wrote:
> This patch adds a bounds check to the bch2_opt_to_text function to prevent
> NULL pointer dereferences when accessing the opt->choices array. This
> ensures that the index used is within valid bounds before dereferencing.
> The new version enhances the readability.
> 
> Reported-and-tested-by: syzbot+37186860aa7812b331d5@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=37186860aa7812b331d5
> Signed-off-by: Mohammed Anees <pvmohammedanees2003@gmail.com>

Sorry for missing this before, applied

Re: [PATCH resend v3] bcachefs: Fix NULL pointer dereference in bch2_opt_to_text

[Hongbo Li]

On 2024/10/8 21:51, Mohammed Anees wrote:
> Hi Hongbo,
> 
>> As definition, max is the right bound for value. opt->max - 1 is valid.
>> May be you should remove the equals sign.
> 
> This is not true, max is not the right upper bound when it comes to
> this but rather the size of the array instead, therefore opt->max - 1
> is where we should stop.
> 
> const struct bch_option bch2_opt_table[] = {
> #define OPT_BOOL()		.type = BCH_OPT_BOOL, .min = 0, .max = 2
> #define OPT_UINT(_min, _max)	.type = BCH_OPT_UINT,			\
> 				.min = _min, .max = _max
> #define OPT_STR(_choices)	.type = BCH_OPT_STR,			\
> 				.min = 0, .max = ARRAY_SIZE(_choices),	\
> 				.choices = _choices
> ...
> 
> Here if you look at OPT_STR you see that it is indeed the size
> of the array.
> 
>> It should be no problem to just solve this null pointer issue() (How is
>> this stack triggered, may be I lost something.), but this should be a
> 
> The reason this is triggered is because in bch2_opt_to_text,
> the parameter v passed is beyond the number of options available
> to Opt_str_hash.
> 
> #define BCH_STR_HASH_OPTS()		\
> 	x(crc32c,		0)	\
> 	x(crc64,		1)	\
> 	x(siphash,		2)
> 

ok, got! the length of bch2_str_hash_types is bigger than 
BCH_STR_HASH_OPTS, I miss this. Thank you.

> Passing a value v of 3 attempts to access a non-existent fourth element.
> This value v corresponds to str_hash in the bch_opts structure within the
> bch_fs struct. Since print_mount_opts checks each option, it seems
> appropriate to add the validation there. Please let me know if
> I've misunderstood anything.

This situation is due to syzbot constructing abnormal data, for example, 
in the case of bool type option, there may not be an exception here, but 
the printed values may no longer be 0 or 1, this will not cause program 
failure, but it does not match the expected value. Moreover, for 
BITFIELD type option, the value may also exceed the number of bits, 
which should also pose a risk of overflow when printing in prt_bitflags.

Thanks,
Hongbo
> 
> Thanks!
>