• Jan Kara's avatar
    reiserfs: Fix oops during mount · c2bb80b8
    Jan Kara authored
    With suitably crafted reiserfs image and mount command reiserfs will
    crash when trying to verify that XATTR_ROOT directory can be looked up
    in / as that recurses back to xattr code like:
    
     xattr_lookup+0x24/0x280 fs/reiserfs/xattr.c:395
     reiserfs_xattr_get+0x89/0x540 fs/reiserfs/xattr.c:677
     reiserfs_get_acl+0x63/0x690 fs/reiserfs/xattr_acl.c:209
     get_acl+0x152/0x2e0 fs/posix_acl.c:141
     check_acl fs/namei.c:277 [inline]
     acl_permission_check fs/namei.c:309 [inline]
     generic_permission+0x2ba/0x550 fs/namei.c:353
     do_inode_permission fs/namei.c:398 [inline]
     inode_permission+0x234/0x4a0 fs/namei.c:463
     lookup_one_len+0xa6/0x200 fs/namei.c:2557
     reiserfs_lookup_privroot+0x85/0x1e0 fs/reiserfs/xattr.c:972
     reiserfs_fill_super+0x2b51/0x3240 fs/reiserfs/super.c:2176
     mount_bdev+0x24f/0x360 fs/super.c:1417
    
    Fix the problem by bailing from reiserfs_xattr_get() when xattrs are not
    yet initialized.
    
    CC: stable@vger.kernel.org
    Reported-by: syzbot+9b33c9b118d77ff59b6f@syzkaller.appspotmail.com
    Signed-off-by: default avatarJan Kara <jack@suse.cz>
    c2bb80b8
xattr.c 25.3 KB