forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ovl: Fix kernel panic while mounting overlayfs

Browse source 
The function ovl_fill_super() in recently multi-layer support
version will incorrectly return 0 at error handling path and
then cause kernel panic.

This failure can be reproduced by mounting a overlayfs with
upperdir and workdir in different mounts.

And also, If the memory allocation of *lower_mnt* fail, this
function may return an zero either.

This patch fix this problem by setting *err* to proper error
number before jumping to error handling path.

Signed-off-by: hujianyang <hujianyang@huawei.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
This commit is contained in:
hujianyang 2015-01-06 12:52:13 +08:00 • committed by Miklos Szeredi
commit 2f83fd8c28
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
fs/overlayfs/super.c
View file

@ -836,6 +836,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
if (err) if (err)
goto out_put_upperpath; goto out_put_upperpath;
err = -EINVAL;
if (upperpath.mnt != workpath.mnt) { if (upperpath.mnt != workpath.mnt) {
pr_err("overlayfs: workdir and upperdir must reside under the same mount\n"); pr_err("overlayfs: workdir and upperdir must reside under the same mount\n");
goto out_put_workpath; goto out_put_workpath;
@ -894,12 +895,14 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
} }
} }
err = -ENOMEM;
ufs->lower_mnt = kcalloc(numlower, sizeof(struct vfsmount *), GFP_KERNEL); ufs->lower_mnt = kcalloc(numlower, sizeof(struct vfsmount *), GFP_KERNEL);
if (ufs->lower_mnt == NULL) if (ufs->lower_mnt == NULL)
goto out_put_workdir; goto out_put_workdir;
for (i = 0; i < numlower; i++) { for (i = 0; i < numlower; i++) {
struct vfsmount *mnt = clone_private_mount(&stack[i]); struct vfsmount *mnt = clone_private_mount(&stack[i]);
err = PTR_ERR(mnt);
if (IS_ERR(mnt)) { if (IS_ERR(mnt)) {
pr_err("overlayfs: failed to clone lowerpath\n"); pr_err("overlayfs: failed to clone lowerpath\n");
goto out_put_lower_mnt; goto out_put_lower_mnt;