[lkml]   [2006]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] hfs: correct return value in hfs_fill_super()
When an invalid hfs filesystem image is mounted it may cause a number of
different oops. One filesystem image which triggers this problem can be
found at:

it was created using the fsfuzzer program which can be found at:

Other such images which oops due to this same bug can be found using the

Inside hfs_fill_super() the return value 'res' is set equal to
hfs_cat_find_brec(). If the return from hfs_cat_find_brec() is failure
it will go to the error path and error out with an error return value.
If however hfs_cat_find_brec() returns success but then any of the
subsequent operations fail it will jump to the error path but the return
value will still be set to success from the hfs_cat_find_brec() call.
This patch simply sets a default return value of -EINVAL after the call
to hfs_cat_find_brec() so the error path will return an error instead of

Although the link above shows the crash in SELinux code this is clearly
an hfs bug. In this particular case hfs_iget() is unable to get the
root_inode and so it goes to bail_no_root: because of this bug we return
success and the s_root in the superblock struct is still 0 (since it was
initialized that way). Later when SELinux actually tries to use the
super block s_root we panic since we are trying to deference a null

Signed-off-by: Eric Paris <>

fs/hfs/super.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index d43b4fc..ab5484e 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -390,6 +390,7 @@ static int hfs_fill_super(struct super_b
goto bail_no_root;
+ res = -EINVAL;
root_inode = hfs_iget(sb, &fd.search_key->cat, &rec);
if (!root_inode)

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2006-11-16 23:23    [W:0.023 / U:4.304 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site