[PATCH] dm-pcache: reject option groups without values

[Samuel Moelius]

The pcache target parses optional arguments as name/value pairs.  A
table that advertises one optional argument and supplies only a
recognized option name, for example "cache_mode", reaches
parse_cache_opts() with argc == 1.  The parser consumes the name,
decrements argc to zero, then calls dm_shift_arg() again for the value.
dm_shift_arg() returns NULL when no arguments remain, and the following
strcmp() dereferences that NULL pointer.

Reject odd optional argument counts before parsing the name/value pairs.
This keeps valid "cache_mode writeback" and "data_crc true/false" tables
unchanged while making malformed tables fail during target construction.

Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@xxxxxxxxxxxxxxx>
---
 drivers/md/dm-pcache/dm_pcache.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/md/dm-pcache/dm_pcache.c b/drivers/md/dm-pcache/dm_pcache.c
index 81c795c0400e..ba5471885b16 100644
--- a/drivers/md/dm-pcache/dm_pcache.c
+++ b/drivers/md/dm-pcache/dm_pcache.c
@@ -163,6 +163,11 @@ static int parse_cache_opts(struct dm_pcache *pcache, struct dm_arg_set *as,
 	if (ret)
 		return -EINVAL;
 
+	if (argc & 1) {
+		*error = "Invalid number of cache option arguments";
+		return -EINVAL;
+	}
+
 	while (argc) {
 		arg = dm_shift_arg(as);
 		argc--;
-- 
2.43.0