Skip to content

Commit c2bb80b

Browse files
committed
reiserfs: Fix oops during mount
With suitably crafted reiserfs image and mount command reiserfs will crash when trying to verify that XATTR_ROOT directory can be looked up in / as that recurses back to xattr code like: xattr_lookup+0x24/0x280 fs/reiserfs/xattr.c:395 reiserfs_xattr_get+0x89/0x540 fs/reiserfs/xattr.c:677 reiserfs_get_acl+0x63/0x690 fs/reiserfs/xattr_acl.c:209 get_acl+0x152/0x2e0 fs/posix_acl.c:141 check_acl fs/namei.c:277 [inline] acl_permission_check fs/namei.c:309 [inline] generic_permission+0x2ba/0x550 fs/namei.c:353 do_inode_permission fs/namei.c:398 [inline] inode_permission+0x234/0x4a0 fs/namei.c:463 lookup_one_len+0xa6/0x200 fs/namei.c:2557 reiserfs_lookup_privroot+0x85/0x1e0 fs/reiserfs/xattr.c:972 reiserfs_fill_super+0x2b51/0x3240 fs/reiserfs/super.c:2176 mount_bdev+0x24f/0x360 fs/super.c:1417 Fix the problem by bailing from reiserfs_xattr_get() when xattrs are not yet initialized. CC: [email protected] Reported-by: [email protected] Signed-off-by: Jan Kara <[email protected]>
1 parent 44ac6b8 commit c2bb80b

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

fs/reiserfs/xattr.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -674,6 +674,13 @@ reiserfs_xattr_get(struct inode *inode, const char *name, void *buffer,
674674
if (get_inode_sd_version(inode) == STAT_DATA_V1)
675675
return -EOPNOTSUPP;
676676

677+
/*
678+
* priv_root needn't be initialized during mount so allow initial
679+
* lookups to succeed.
680+
*/
681+
if (!REISERFS_SB(inode->i_sb)->priv_root)
682+
return 0;
683+
677684
dentry = xattr_lookup(inode, name, XATTR_REPLACE);
678685
if (IS_ERR(dentry)) {
679686
err = PTR_ERR(dentry);

0 commit comments

Comments
 (0)