Received-SPF: pass (google.com: domain of linux-kernel+bounces-15522-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Message-ID: <tencent_364B28745976AD66CC3D7137029706364609@qq.com>
From: Edward Adam Davis <eadavis@qq.com>
To: syzbot+74dce9511a59ad67a492@syzkaller.appspotmail.com
Cc: linux-fsdevel@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	reiserfs-devel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: [PATCH] reiserfs: fix null ptr deref in reiserfs_xattr_set
Date: Wed,  3 Jan 2024 20:40:13 +0800
In-Reply-To: <0000000000009d4b80060df41cf8@google.com>
References: <0000000000009d4b80060df41cf8@google.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Before performing any xattr settings, it is necessary to first confirm that both
xattr_root and priv_root are valid.

Reported-and-tested-by: syzbot+74dce9511a59ad67a492@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com
---
 fs/reiserfs/xattr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index 998035a6388e..00fd8f747394 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -618,6 +618,9 @@ int reiserfs_xattr_set(struct inode *inode, const char *name,
 	int error, error2;
 	size_t jbegin_count = reiserfs_xattr_nblocks(inode, buffer_size);
 
+	if (!reiserfs_xattrs_initialized(inode->i_sb))
+		return -EOPNOTSUPP;
+
 	/* Check before we start a transaction and then do nothing. */
 	if (!d_really_is_positive(REISERFS_SB(inode->i_sb)->priv_root))
 		return -EOPNOTSUPP;
-- 
2.43.0