linux/fs/afs
David Howells 5e0b17b026 afs: Fix NULL deref in afs_dynroot_depopulate()
If an error occurs during the construction of an afs superblock, it's
possible that an error occurs after a superblock is created, but before
we've created the root dentry.  If the superblock has a dynamic root
(ie.  what's normally mounted on /afs), the afs_kill_super() will call
afs_dynroot_depopulate() to unpin any created dentries - but this will
oops if the root hasn't been created yet.

Fix this by skipping that bit of code if there is no root dentry.

This leads to an oops looking like:

	general protection fault, ...
	KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]
	...
	RIP: 0010:afs_dynroot_depopulate+0x25f/0x529 fs/afs/dynroot.c:385
	...
	Call Trace:
	 afs_kill_super+0x13b/0x180 fs/afs/super.c:535
	 deactivate_locked_super+0x94/0x160 fs/super.c:335
	 afs_get_tree+0x1124/0x1460 fs/afs/super.c:598
	 vfs_get_tree+0x89/0x2f0 fs/super.c:1547
	 do_new_mount fs/namespace.c:2875 [inline]
	 path_mount+0x1387/0x2070 fs/namespace.c:3192
	 do_mount fs/namespace.c:3205 [inline]
	 __do_sys_mount fs/namespace.c:3413 [inline]
	 __se_sys_mount fs/namespace.c:3390 [inline]
	 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
	 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
	 entry_SYSCALL_64_after_hwframe+0x44/0xa9

which is oopsing on this line:

	inode_lock(root->d_inode);

presumably because sb->s_root was NULL.

Fixes: 0da0b7fd73 ("afs: Display manually added cells in dynamic root mount")
Reported-by: syzbot+c1eff8205244ae7e11a6@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-08-21 10:56:40 -07:00
..
Kconfig docs: filesystems: fix renamed references 2020-04-20 15:45:22 -06:00
Makefile afs: Detect cell aliases 1 - Cells with root volumes 2020-06-04 15:37:57 +01:00
addr_list.c afs: Use kfree_rcu() instead of casting kfree() to rcu_callback_t 2020-03-13 10:47:33 -07:00
afs.h afs: Implement client support for the YFSVL.GetCellName RPC op 2020-06-04 15:37:57 +01:00
afs_cm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
afs_fs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
afs_vl.h afs: Implement client support for the YFSVL.GetCellName RPC op 2020-06-04 15:37:57 +01:00
cache.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
callback.c afs: Fix the by-UUID server tree to allow servers with the same UUID 2020-06-04 15:37:57 +01:00
cell.c afs: Fix storage of cell names 2020-06-27 22:04:24 -07:00
cmservice.c afs: Fix handling of CB.ProbeUuid cache manager op 2020-06-04 15:37:57 +01:00
dir.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
dir_edit.c afs: Remove set but not used variables 'before', 'after' 2019-11-21 20:36:00 +00:00
dir_silly.c afs: Fix silly rename 2020-06-16 22:00:28 +01:00
dynroot.c afs: Fix NULL deref in afs_dynroot_depopulate() 2020-08-21 10:56:40 -07:00
file.c afs: Fix use of afs_check_for_remote_deletion() 2020-06-16 16:26:57 +01:00
flock.c afs: Fix use of afs_check_for_remote_deletion() 2020-06-16 16:26:57 +01:00
fs_operation.c afs: Fix key ref leak in afs_put_operation() 2020-08-20 10:41:45 -07:00
fs_probe.c afs: Fix hang on rmmod due to outstanding timer 2020-06-20 12:01:58 -07:00
fsclient.c afs: Reorganise volume and server trees to be rooted on the cell 2020-06-04 15:37:57 +01:00
inode.c afs: Fix silly rename 2020-06-16 22:00:28 +01:00
internal.h afs: Fix storage of cell names 2020-06-27 22:04:24 -07:00
main.c afs: Fix hang on rmmod due to outstanding timer 2020-06-20 12:01:58 -07:00
misc.c afs: Fix the mapping of the UAEOVERFLOW abort code 2020-06-15 15:41:03 +01:00
mntpt.c afs: Fix mountpoint parsing 2019-12-11 16:56:54 +00:00
proc.c afs: Fix memory leak in afs_put_sysnames() 2020-06-09 15:22:06 +01:00
protocol_uae.h afs: Add support for the UAE error table 2019-06-28 18:37:53 +01:00
protocol_yfs.h afs: Implement client support for the YFSVL.GetCellName RPC op 2020-06-04 15:37:57 +01:00
rotate.c afs: Adjust the fileserver rotation algorithm to reprobe/retry more quickly 2020-06-04 15:37:58 +01:00
rxrpc.c AFS Changes 2020-06-05 16:26:36 -07:00
security.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
server.c afs: Fix hang on rmmod due to outstanding timer 2020-06-20 12:01:58 -07:00
server_list.c afs: Reorganise volume and server trees to be rooted on the cell 2020-06-04 15:37:57 +01:00
super.c afs: Fix afs_statfs() to not let the values go below zero 2020-06-04 15:37:58 +01:00
vl_alias.c afs: Fix debugging statements with %px to be %p 2020-06-09 18:17:14 +01:00
vl_list.c fs/afs: Replace rcu_swap_protected() with rcu_replace_pointer() 2019-10-30 08:44:27 -07:00
vl_probe.c rxrpc: Fix the excessive initial retransmission timeout 2020-05-11 16:42:28 +01:00
vl_rotate.c afs: Detect cell aliases 3 - YFS Cells with a canonical cell name op 2020-06-04 15:37:57 +01:00
vlclient.c afs: Implement client support for the YFSVL.GetCellName RPC op 2020-06-04 15:37:57 +01:00
volume.c afs: Reorganise volume and server trees to be rooted on the cell 2020-06-04 15:37:57 +01:00
write.c afs: Fix interruption of operations 2020-07-15 15:49:04 -07:00
xattr.c afs: Build an abstraction around an "operation" concept 2020-06-04 15:37:17 +01:00
xdr_fs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
yfsclient.c afs: Fix yfs_fs_fetch_status() to honour vnode selector 2020-06-16 16:26:57 +01:00