lkml.org 
[lkml]   [2018]   [Sep]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 50/63] hfsplus: fix NULL dereference in hfsplus_lookup()
    3.16.58-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Ernesto A. Fernández
    <ernesto.mnd.fernandez@gmail.com>

    commit a7ec7a4193a2eb3b5341243fc0b621c1ac9e4ec4 upstream.

    An HFS+ filesystem can be mounted read-only without having a metadata
    directory, which is needed to support hardlinks. But if the catalog
    data is corrupted, a directory lookup may still find dentries claiming
    to be hardlinks.

    hfsplus_lookup() does check that ->hidden_dir is not NULL in such a
    situation, but mistakenly does so after dereferencing it for the first
    time. Reorder this check to prevent a crash.

    This happens when looking up corrupted catalog data (dentry) on a
    filesystem with no metadata directory (this could only ever happen on a
    read-only mount). Wen Xu sent the replication steps in detail to the
    fsdevel list: https://bugzilla.kernel.org/show_bug.cgi?id=200297

    Link: http://lkml.kernel.org/r/20180712215344.q44dyrhymm4ajkao@eaf
    Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
    Reported-by: Wen Xu <wen.xu@gatech.edu>
    Cc: Viacheslav Dubeyko <slava@dubeyko.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.16: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    fs/hfsplus/dir.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/fs/hfsplus/dir.c
    +++ b/fs/hfsplus/dir.c
    @@ -74,13 +74,13 @@ again:
    cpu_to_be32(HFSP_HARDLINK_TYPE) &&
    entry.file.user_info.fdCreator ==
    cpu_to_be32(HFSP_HFSPLUS_CREATOR) &&
    + HFSPLUS_SB(sb)->hidden_dir &&
    (entry.file.create_date ==
    HFSPLUS_I(HFSPLUS_SB(sb)->hidden_dir)->
    create_date ||
    entry.file.create_date ==
    HFSPLUS_I(sb->s_root->d_inode)->
    - create_date) &&
    - HFSPLUS_SB(sb)->hidden_dir) {
    + create_date)) {
    struct qstr str;
    char name[32];

    \
     
     \ /
      Last update: 2018-09-22 02:24    [W:4.176 / U:0.676 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site