diff options
| author | hujianyang <hujianyang@huawei.com> | 2015-01-06 12:52:13 +0800 |
|---|---|---|
| committer | Miklos Szeredi <mszeredi@suse.cz> | 2015-01-08 14:47:20 +0100 |
| commit | 2f83fd8c2849a388082f30d755a75c1e67c4643b (patch) | |
| tree | 09ed1bd07d358487a7a7f3ed3ac863422c2eabdc /fs/overlayfs | |
| parent | 2b7a8f36f092a7855f6438cd42d6990394f450fa (diff) | |
| download | lwn-2f83fd8c2849a388082f30d755a75c1e67c4643b.tar.gz lwn-2f83fd8c2849a388082f30d755a75c1e67c4643b.zip | |
ovl: Fix kernel panic while mounting overlayfs
The function ovl_fill_super() in recently multi-layer support
version will incorrectly return 0 at error handling path and
then cause kernel panic.
This failure can be reproduced by mounting a overlayfs with
upperdir and workdir in different mounts.
And also, If the memory allocation of *lower_mnt* fail, this
function may return an zero either.
This patch fix this problem by setting *err* to proper error
number before jumping to error handling path.
Signed-off-by: hujianyang <hujianyang@huawei.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Diffstat (limited to 'fs/overlayfs')
| -rw-r--r-- | fs/overlayfs/super.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index 84f3144e1b33..6ca8ea8cb9b2 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -836,6 +836,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) if (err) goto out_put_upperpath; + err = -EINVAL; if (upperpath.mnt != workpath.mnt) { pr_err("overlayfs: workdir and upperdir must reside under the same mount\n"); goto out_put_workpath; @@ -894,12 +895,14 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) } } + err = -ENOMEM; ufs->lower_mnt = kcalloc(numlower, sizeof(struct vfsmount *), GFP_KERNEL); if (ufs->lower_mnt == NULL) goto out_put_workdir; for (i = 0; i < numlower; i++) { struct vfsmount *mnt = clone_private_mount(&stack[i]); + err = PTR_ERR(mnt); if (IS_ERR(mnt)) { pr_err("overlayfs: failed to clone lowerpath\n"); goto out_put_lower_mnt; |