lkml.org 
[lkml]   [2021]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 31/52] reiserfs: update reiserfs_xattrs_initialized() condition
    Date
    From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>

    commit 5e46d1b78a03d52306f21f77a4e4a144b6d31486 upstream.

    syzbot is reporting NULL pointer dereference at reiserfs_security_init()
    [1], for commit ab17c4f02156c4f7 ("reiserfs: fixup xattr_root caching")
    is assuming that REISERFS_SB(s)->xattr_root != NULL in
    reiserfs_xattr_jcreate_nblocks() despite that commit made
    REISERFS_SB(sb)->priv_root != NULL && REISERFS_SB(s)->xattr_root == NULL
    case possible.

    I guess that commit 6cb4aff0a77cc0e6 ("reiserfs: fix oops while creating
    privroot with selinux enabled") wanted to check xattr_root != NULL
    before reiserfs_xattr_jcreate_nblocks(), for the changelog is talking
    about the xattr root.

    The issue is that while creating the privroot during mount
    reiserfs_security_init calls reiserfs_xattr_jcreate_nblocks which
    dereferences the xattr root. The xattr root doesn't exist, so we get
    an oops.

    Therefore, update reiserfs_xattrs_initialized() to check both the
    privroot and the xattr root.

    Link: https://syzkaller.appspot.com/bug?id=8abaedbdeb32c861dc5340544284167dd0e46cde # [1]
    Reported-and-tested-by: syzbot <syzbot+690cb1e51970435f9775@syzkaller.appspotmail.com>
    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Fixes: 6cb4aff0a77c ("reiserfs: fix oops while creating privroot with selinux enabled")
    Acked-by: Jeff Mahoney <jeffm@suse.com>
    Acked-by: Jan Kara <jack@suse.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/reiserfs/xattr.h | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/reiserfs/xattr.h
    +++ b/fs/reiserfs/xattr.h
    @@ -43,7 +43,7 @@ void reiserfs_security_free(struct reise

    static inline int reiserfs_xattrs_initialized(struct super_block *sb)
    {
    - return REISERFS_SB(sb)->priv_root != NULL;
    + return REISERFS_SB(sb)->priv_root && REISERFS_SB(sb)->xattr_root;
    }

    #define xattr_size(size) ((size) + sizeof(struct reiserfs_xattr_header))

    \
     
     \ /
      Last update: 2021-04-05 11:02    [W:4.086 / U:0.688 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site