reiserfs: update reiserfs_xattrs_initialized() condition
syzbot is reporting NULL pointer dereference at reiserfs_security_init() [1], for commitab17c4f021
("reiserfs: fixup xattr_root caching") is assuming that REISERFS_SB(s)->xattr_root != NULL in reiserfs_xattr_jcreate_nblocks() despite that commit made REISERFS_SB(sb)->priv_root != NULL && REISERFS_SB(s)->xattr_root == NULL case possible. I guess that commit6cb4aff0a7
("reiserfs: fix oops while creating privroot with selinux enabled") wanted to check xattr_root != NULL before reiserfs_xattr_jcreate_nblocks(), for the changelog is talking about the xattr root. The issue is that while creating the privroot during mount reiserfs_security_init calls reiserfs_xattr_jcreate_nblocks which dereferences the xattr root. The xattr root doesn't exist, so we get an oops. Therefore, update reiserfs_xattrs_initialized() to check both the privroot and the xattr root. Link: https://syzkaller.appspot.com/bug?id=8abaedbdeb32c861dc5340544284167dd0e46cde # [1] Reported-and-tested-by: syzbot <syzbot+690cb1e51970435f9775@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Fixes:6cb4aff0a7
("reiserfs: fix oops while creating privroot with selinux enabled") Acked-by: Jeff Mahoney <jeffm@suse.com> Acked-by: Jan Kara <jack@suse.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Родитель
6ac86aae89
Коммит
5e46d1b78a
|
@ -44,7 +44,7 @@ void reiserfs_security_free(struct reiserfs_security_handle *sec);
|
|||
|
||||
static inline int reiserfs_xattrs_initialized(struct super_block *sb)
|
||||
{
|
||||
return REISERFS_SB(sb)->priv_root != NULL;
|
||||
return REISERFS_SB(sb)->priv_root && REISERFS_SB(sb)->xattr_root;
|
||||
}
|
||||
|
||||
#define xattr_size(size) ((size) + sizeof(struct reiserfs_xattr_header))
|
||||
|
|
Загрузка…
Ссылка в новой задаче