Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f83fd8c authored by hujianyang's avatar hujianyang Committed by Miklos Szeredi
Browse files

ovl: Fix kernel panic while mounting overlayfs 



The function ovl_fill_super() in recently multi-layer support
version will incorrectly return 0 at error handling path and
then cause kernel panic.

This failure can be reproduced by mounting a overlayfs with
upperdir and workdir in different mounts.

And also, If the memory allocation of *lower_mnt* fail, this
function may return an zero either.

This patch fix this problem by setting *err* to proper error
number before jumping to error handling path.

Signed-off-by: default avatarhujianyang <hujianyang@huawei.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
parent 2b7a8f36

fs/overlayfs/super.c

+3 −0
Original line number Diff line number Diff line
@@ -836,6 +836,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) 
		if (err)

			goto out_put_upperpath;



		err = -EINVAL;

		if (upperpath.mnt != workpath.mnt) {

			pr_err("overlayfs: workdir and upperdir must reside under the same mount\n");

			goto out_put_workpath;
@@ -894,12 +895,14 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) 
		}

	}



	err = -ENOMEM;

	ufs->lower_mnt = kcalloc(numlower, sizeof(struct vfsmount *), GFP_KERNEL);

	if (ufs->lower_mnt == NULL)

		goto out_put_workdir;

	for (i = 0; i < numlower; i++) {

		struct vfsmount *mnt = clone_private_mount(&stack[i]);



		err = PTR_ERR(mnt);

		if (IS_ERR(mnt)) {

			pr_err("overlayfs: failed to clone lowerpath\n");

			goto out_put_lower_mnt;