Commit c2bb80b8 authored Sep 30, 2020 by Jan Kara

reiserfs: Fix oops during mount



With suitably crafted reiserfs image and mount command reiserfs will
crash when trying to verify that XATTR_ROOT directory can be looked up
in / as that recurses back to xattr code like:

 xattr_lookup+0x24/0x280 fs/reiserfs/xattr.c:395
 reiserfs_xattr_get+0x89/0x540 fs/reiserfs/xattr.c:677
 reiserfs_get_acl+0x63/0x690 fs/reiserfs/xattr_acl.c:209
 get_acl+0x152/0x2e0 fs/posix_acl.c:141
 check_acl fs/namei.c:277 [inline]
 acl_permission_check fs/namei.c:309 [inline]
 generic_permission+0x2ba/0x550 fs/namei.c:353
 do_inode_permission fs/namei.c:398 [inline]
 inode_permission+0x234/0x4a0 fs/namei.c:463
 lookup_one_len+0xa6/0x200 fs/namei.c:2557
 reiserfs_lookup_privroot+0x85/0x1e0 fs/reiserfs/xattr.c:972
 reiserfs_fill_super+0x2b51/0x3240 fs/reiserfs/super.c:2176
 mount_bdev+0x24f/0x360 fs/super.c:1417

Fix the problem by bailing from reiserfs_xattr_get() when xattrs are not
yet initialized.

CC: stable@vger.kernel.org
Reported-by:  <syzbot+9b33c9b118d77ff59b6f@syzkaller.appspotmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>

parent 44ac6b82

fs/reiserfs/xattr.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -674,6 +674,13 @@ reiserfs_xattr_get(struct inode inode, const char name, void *buffer,
		if (get_inode_sd_version(inode) == STAT_DATA_V1)
		return -EOPNOTSUPP;

		/*
		* priv_root needn't be initialized during mount so allow initial
		* lookups to succeed.
		*/
		if (!REISERFS_SB(inode->i_sb)->priv_root)
		return 0;

		dentry = xattr_lookup(inode, name, XATTR_REPLACE);
		if (IS_ERR(dentry)) {
		err = PTR_ERR(dentry);

Admin message