From patchwork Thu May 3 22:10:36 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Ernesto_A=2E_Fern=C3=A1ndez?= X-Patchwork-Id: 10379387 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1AA1060327 for ; Thu, 3 May 2018 22:10:53 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 00B3329292 for ; Thu, 3 May 2018 22:10:53 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E9238292B1; Thu, 3 May 2018 22:10:52 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2E5DA29282 for ; Thu, 3 May 2018 22:10:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751181AbeECWKs (ORCPT ); Thu, 3 May 2018 18:10:48 -0400 Received: from mail-qk0-f193.google.com ([209.85.220.193]:34760 "EHLO mail-qk0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751111AbeECWKl (ORCPT ); Thu, 3 May 2018 18:10:41 -0400 Received: by mail-qk0-f193.google.com with SMTP id p186so15213566qkd.1 for ; Thu, 03 May 2018 15:10:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=m/UVt7tyzSjGyHQWlHIzfnNVcLV2G5CCd05AcGXc50M=; b=Mhnf7EcuerEs0fgEtRURMmw+yuul14ypUZyVJAH09gHmorM1oEWKQsl+uv47UE0brF LkMRpWqgHlF+4Y/TKu8l6wUSPp4ZwrQmanUWqXfZ68YWc8GMUf3revUHXP4pPpX9pB+v Ia1c+5+vaK5Ai4RDudYvFPIL75MDLCN97I7fnvdI6h7yMmToq6MnKV9RKr8ZpqPSyh5K CcrZhd0jH2PAOtryUUCtLcY0hsxPyhLOjRq+2ejvpQ0H1JAIIYFzfTOGkaU/6jM20LLf 7Nzl1mym2Q9WOv2MWbrk2Aty5jMzNN6foqZOk8AGfX958EUWeDej8Sd+IGjTrYUHs3kU VSBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=m/UVt7tyzSjGyHQWlHIzfnNVcLV2G5CCd05AcGXc50M=; b=dZri3HptDkx1aGFbwKyASlxxpolS8tPXOfldBuD8hCjz1lBBsqYMJBoFniodrNzqC1 z+s/ly2QhOlmNtsI/l+PiNAFAEcdvNYvabJQ+JnNynZXZ8s+nG/tJOiIGJMjvedfUYQQ 20UHm79nQ/0d5O3t1ZFYvu1e8o0v8UAPzVYDivjwAlqA1BwIoQxJeEeuY6H4NMi/B7SD ACHBJhZmuLbTJUDJVfdy3yXChP8StMB9JqiOFagmxjVTpNgGFGcfMpgyANz/0vgNQfJQ aZhXrTYSPG7Vo8F0pppRwVdNh7yhMnPd0KjtFEphsJ95E5cgbtRMQlYoE/wzPch5qOAJ kN3A== X-Gm-Message-State: ALQs6tDrgsSQby5xUnK2jf0awSE1J8Bw+HTVkhUN1O/1PhvDki1ieCHo /ftmAJchVc8AyAmUerN1Zk0= X-Google-Smtp-Source: AB8JxZooImp18xrqjKPAjWKd+5dQACBKaL1x6ki0UWAcziEafddoOBjk2d5Z4dWnRCypiMg/w4XmhA== X-Received: by 10.55.215.140 with SMTP id t12mr20861398qkt.148.1525385440951; Thu, 03 May 2018 15:10:40 -0700 (PDT) Received: from eaf ([181.47.179.0]) by smtp.gmail.com with ESMTPSA id q2sm11062850qkb.53.2018.05.03.15.10.39 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Thu, 03 May 2018 15:10:40 -0700 (PDT) Date: Thu, 3 May 2018 19:10:36 -0300 From: Ernesto =?utf-8?Q?A=2E_Fern=C3=A1ndez?= To: syzbot Cc: Andrew Morton , Christoph Hellwig , Alexey Khoroshilov , Artem Bityutskiy , Ernesto =?utf-8?Q?A=2E_Fern=C3=A1ndez?= , linux-fsdevel@vger.kernel.org Subject: [PATCH 2/2] hfsplus: always return error if fill_super fails Message-ID: <8285926250376eb393b69877251b0d6e743b7930.1525384742.git.ernesto.mnd.fernandez@gmail.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If the filesystem is corrupted in such a way that the HFS+ Private Data directory is not of type HFSPLUS_FOLDER, the mount will fail without throwing an error code. The vfs layer is then forced to dereference a NULL root dentry. This bug was found by KASAN while running the reproducer provided by syzbot+4f2e5f086147d543ab03@syzkaller.appspotmail.com for a separate issue. Fixes: 5bd9d99d107c ("hfsplus: add error checking for hfs_find_init()") Signed-off-by: Ernesto A. Fernández --- fs/hfsplus/super.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c index 4bc49e3f171d..4f62634c5666 100644 --- a/fs/hfsplus/super.c +++ b/fs/hfsplus/super.c @@ -524,8 +524,10 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent) goto out_put_root; if (!hfs_brec_read(&fd, &entry, sizeof(entry))) { hfs_find_exit(&fd); - if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) + if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) { + err = -EINVAL; goto out_put_root; + } inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id)); if (IS_ERR(inode)) { err = PTR_ERR(inode);