Re: cramfs mounts provide corrupted content since 2.6.15

From: Chris Mason
Date: Tue Feb 28 2006 - 14:12:57 EST


On Monday 27 February 2006 11:31, Dave Johnson wrote:

> I think I've spotted an issue.
>
> Both ifind() and find_inode() will call the test function on inodes
> that still have I_LOCK|I_NEW set. This means everything that the
> test function needs _must_ be set in the set function (which is called
> while the inode_lock is still held).
>
> This could cause issues for inodes of 1 (only i_ino is getting set
> right now).

The problem is that two files are getting the same inode number because
their offsets are the same.

ls -lai:
3412140 -rw-r--r-- 1 root root 0 Jan 1 1970 ./etc/mtab
3412140 -rw-r--r-- 1 root root 1220 Jan 1 1970 ./etc/nsswitch.conf

So, if /etc/mtab is read first, /etc/nsswitch.conf ends up with size zero,
because it uses the mtab inode.

Andreas Gruenbacher suggested this change. Along with your patch, things
are working here again:

-chris

diff -r 0f4fc87886c2 fs/cramfs/inode.c
--- a/fs/cramfs/inode.c Fri Feb 24 16:18:23 2006 -0500
+++ b/fs/cramfs/inode.c Tue Feb 28 14:00:11 2006 -0500
@@ -36,7 +36,7 @@ static DECLARE_MUTEX(read_mutex);

/* These two macros may change in future, to provide better st_ino
semantics. */
-#define CRAMINO(x) ((x)->offset?(x)->offset<<2:1)
+#define CRAMINO(x) (((x)->offset && (x)->size)?(x)->offset<<2:1)
#define OFFSET(x) ((x)->i_ino)


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/