Fix possible NULL dereference in get_btrfs_fs_root()
PATCH 1/1 Fix possible NULL dereference in get_btrfs_fs_root()
Be on safe side and always initialize mountinfo in set_fs_root().
I got a crash report in get_btrfs_fs_root() caused by tb being zero while referring tb->cache in
target = mnt_resolve_target(mnt_fs_get_target(fs), tb->cache);
Triggered by command:
mount -t btrfs -o user /dev/sdh1 /media/sdh1
However I was not able to reproduce the crash, the reason was apparent.
NULL tb was passed to mnt_table_get_fs_root() from set_fs_root().
set_fs_root() got it as upd->mountinfo being NULL from utab_new_entry(). That got it from mnt_update_set_fs(), that from mnt_context_prepare_update() (where it is cxt->update->mountinfo).
At least the constructor mnt_new_update() can create context with cxt->update being not NULL and cxt->update->mountinfo being NULL.
It is also possible to pass to mnt_context_prepare_update() with cxt->update not being NULL but cxt->update->mountinfo being NULL created by mnt_new_context(), e. g. from mnt_context_mount().
--- libmount/src/tab_update.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
libmount/src/tab_update.c +3 -2
@@ -366,9 +366,10 @@ static int set_fs_root(struct libmnt_update *upd, struct libmnt_fs *fs,assert (upd->fs);assert (fs); +if (!upd->mountinfo) + upd->mountinfo =mnt_new_table_from_file (_PATH_PROC_MOUNTINFO); +if (mountflags &MS_BIND ) { -if (!upd->mountinfo) - upd->mountinfo =mnt_new_table_from_file (_PATH_PROC_MOUNTINFO); src =mnt_fs_get_srcpath (fs);if (src) {
Signature · 13 lines
2.7.3 -- Best Regards / S pozdravem, Stanislav Brabec software developer --------------------------------------------------------------------- SUSE LINUX, s. r. o. e-mail: [email protected] Lihovarská 1060/12 tel: +49 911 7405384547 190 00 Praha 9 fax: +420 284 084 001 Czech Republic http://www.suse.cz/ PGP: 830B 40D5 9E05 35D8 5E27 6FA3 717C 209F A04F CD76
Karel Zak
maintainerQuoted 10 lines · Stanislav Brabec
set_fs_root()got it asupd->mountinfobeing NULL fromutab_new_entry(). That got it frommnt_update_set_fs(), that frommnt_context_prepare_update()(where it iscxt->update->mountinfo).At least the constructor
mnt_new_update()can create context withcxt->updatebeing not NULL andcxt->update->mountinfobeing NULL.It is also possible to pass to
mnt_context_prepare_update()withcxt->updatenot being NULL butcxt->update->mountinfobeing NULL created bymnt_new_context(), e. g. frommnt_context_mount().
It's seems better to read mountinfo when really necessary than always. I have applied something else:
https://github.com/karelzak/util-linux/commit/e9cd2e2bd9ec91a0b1050c4aa79555d142985924
Thanks!
Karel
Signature · 2 lines
Karel Zak <[email protected]> http://karelzak.blogspot.com
Quoted 8 lines · On Mar 31, 2016 at 11:54 Karel Zak wrote:
Quoted 7 lines · Stanislav Brabec
set_fs_root()got it asupd->mountinfobeing NULL fromutab_new_entry(). That got it frommnt_update_set_fs(), that frommnt_context_prepare_update()(where it iscxt->update->mountinfo).At least the constructor
mnt_new_update()can create context withcxt->updatebeing not NULL andcxt->update->mountinfobeing NULL.
Quoted 8 lines
Quoted 3 lines
It is also possible to pass to
mnt_context_prepare_update()withcxt->updatenot being NULL butcxt->update->mountinfobeing NULL created bymnt_new_context(), e. g. frommnt_context_mount().It's seems better to read mountinfo when really necessary than always. I have applied something else:
https://github.com/karelzak/util-linux/commit/e9cd2e2bd9ec91a0b1050c4aa79555d142985924
I just got a positive feedback. My original patch as well as your patch fix the crash.
Thanks.
Signature · 10 lines
Best Regards / S pozdravem, Stanislav Brabec software developer --------------------------------------------------------------------- SUSE LINUX, s. r. o. e-mail: [email protected] Lihovarská 1060/12 tel: +49 911 7405384547 190 00 Praha 9 fax: +420 284 084 001 Czech Republic http://www.suse.cz/ PGP: 830B 40D5 9E05 35D8 5E27 6FA3 717C 209F A04F CD76