summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorhujianyang <hujianyang@huawei.com>2015-01-06 12:52:13 +0800
committerMiklos Szeredi <mszeredi@suse.cz>2015-01-08 14:47:20 +0100
commit2f83fd8c2849a388082f30d755a75c1e67c4643b (patch)
tree09ed1bd07d358487a7a7f3ed3ac863422c2eabdc
parent2b7a8f36f092a7855f6438cd42d6990394f450fa (diff)
downloadlinux-2f83fd8c2849a388082f30d755a75c1e67c4643b.tar.gz
linux-2f83fd8c2849a388082f30d755a75c1e67c4643b.tar.bz2
linux-2f83fd8c2849a388082f30d755a75c1e67c4643b.zip
ovl: Fix kernel panic while mounting overlayfs
The function ovl_fill_super() in recently multi-layer support version will incorrectly return 0 at error handling path and then cause kernel panic. This failure can be reproduced by mounting a overlayfs with upperdir and workdir in different mounts. And also, If the memory allocation of *lower_mnt* fail, this function may return an zero either. This patch fix this problem by setting *err* to proper error number before jumping to error handling path. Signed-off-by: hujianyang <hujianyang@huawei.com> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
-rw-r--r--fs/overlayfs/super.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 84f3144e1b33..6ca8ea8cb9b2 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -836,6 +836,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
if (err)
goto out_put_upperpath;
+ err = -EINVAL;
if (upperpath.mnt != workpath.mnt) {
pr_err("overlayfs: workdir and upperdir must reside under the same mount\n");
goto out_put_workpath;
@@ -894,12 +895,14 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
}
}
+ err = -ENOMEM;
ufs->lower_mnt = kcalloc(numlower, sizeof(struct vfsmount *), GFP_KERNEL);
if (ufs->lower_mnt == NULL)
goto out_put_workdir;
for (i = 0; i < numlower; i++) {
struct vfsmount *mnt = clone_private_mount(&stack[i]);
+ err = PTR_ERR(mnt);
if (IS_ERR(mnt)) {
pr_err("overlayfs: failed to clone lowerpath\n");
goto out_put_lower_mnt;