• Yu Kuai's avatar
    reiserfs: add check for root_inode in reiserfs_fill_super · 2acf15b9
    Yu Kuai authored
    Our syzcaller report a NULL pointer dereference:
    
    BUG: kernel NULL pointer dereference, address: 0000000000000000
    PGD 116e95067 P4D 116e95067 PUD 1080b5067 PMD 0
    Oops: 0010 [#1] SMP KASAN
    CPU: 7 PID: 592 Comm: a.out Not tainted 5.13.0-next-20210629-dirty #67
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4
    RIP: 0010:0x0
    Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
    RSP: 0018:ffff888114e779b8 EFLAGS: 00010246
    RAX: 0000000000000000 RBX: 1ffff110229cef39 RCX: ffffffffaa67e1aa
    RDX: 0000000000000000 RSI: ffff88810a58ee00 RDI: ffff8881233180b0
    RBP: ffffffffac38e9c0 R08: ffffffffaa67e17e R09: 0000000000000001
    R10: ffffffffb91c5557 R11: fffffbfff7238aaa R12: ffff88810a58ee00
    R13: ffff888114e77aa0 R14: 0000000000000000 R15: ffff8881233180b0
    FS:  00007f946163c480(0000) GS:ffff88839f1c0000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: ffffffffffffffd6 CR3: 00000001099c1000 CR4: 00000000000006e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     __lookup_slow+0x116/0x2d0
     ? page_put_link+0x120/0x120
     ? __d_lookup+0xfc/0x320
     ? d_lookup+0x49/0x90
     lookup_one_len+0x13c/0x170
     ? __lookup_slow+0x2d0/0x2d0
     ? reiserfs_schedule_old_flush+0x31/0x130
     reiserfs_lookup_privroot+0x64/0x150
     reiserfs_fill_super+0x158c/0x1b90
     ? finish_unfinished+0xb10/0xb10
     ? bprintf+0xe0/0xe0
     ? __mutex_lock_slowpath+0x30/0x30
     ? __kasan_check_write+0x20/0x30
     ? up_write+0x51/0xb0
     ? set_blocksize+0x9f/0x1f0
     mount_bdev+0x27c/0x2d0
     ? finish_unfinished+0xb10/0xb10
     ? reiserfs_kill_sb+0x120/0x120
     get_super_block+0x19/0x30
     legacy_get_tree+0x76/0xf0
     vfs_get_tree+0x49/0x160
     ? capable+0x1d/0x30
     path_mount+0xacc/0x1380
     ? putname+0x97/0xd0
     ? finish_automount+0x450/0x450
     ? kmem_cache_free+0xf8/0x5a0
     ? putname+0x97/0xd0
     do_mount+0xe2/0x110
     ? path_mount+0x1380/0x1380
     ? copy_mount_options+0x69/0x140
     __x64_sys_mount+0xf0/0x190
     do_syscall_64+0x35/0x80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    This is because 'root_inode' is initialized with wrong mode, and
    it's i_op is set to 'reiserfs_special_inode_operations'. Thus add
    check for 'root_inode' to fix the problem.
    
    Link: https://lore.kernel.org/r/20210702040743.1918552-1-yukuai3@huawei.comSigned-off-by: default avatarYu Kuai <yukuai3@huawei.com>
    Signed-off-by: default avatarJan Kara <jack@suse.cz>
    2acf15b9
super.c 70.2 KB