[PATCH] erofs: reject turning inode_share on during remount

[PATCH] erofs: reject turning inode_share on during remount

[Gou Hao]

The inode_share and domain_id constraint is validated when a
superblock is initialized, but remount replaces the live mount options
with a newly parsed option set without rechecking it.

Therefore a filesystem mounted without domain_id can enable inode_share
by remount.  For an image with ishare xattrs, the next lookup of a
regular file then passes a NULL domain_id to
erofs_xattr_fill_inode_fingerprint() and crashes.

Since domain_id cannot be changed by remount, reject turning inode_share
on during remount.

Reproducer:

	mkfs.erofs --xattr-inode-digest=erofs.fingerprint.v1 img  man/
	mount img t
	mount -o remount,inode_share t
	ls t/

Full crash log:

[   50.416381] erofs (device loop0): mounted with root inode @ nid 37.
[   78.553276] BUG: kernel NULL pointer dereference, address: 0000000000000000
[   78.553882] #PF: supervisor read access in kernel mode
[   78.554326] #PF: error_code(0x0000) - not-present page
[   78.554762] PGD 0 P4D 0
[   78.555014] Oops: Oops: 0000 [#1] SMP NOPTI
[   78.555423] CPU: 4 UID: 0 PID: 4446 Comm: ls Kdump: loaded Not tainted 7.3.0-erofs #2 PREEMPTLAZY
[   78.556105] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[   78.556942] RIP: 0010:strlen+0x0/0x20
[   78.557284] Code: f7 75 ec 31 c0 e9 40 76 02 00 48 89 f8 c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 e9 07
[   78.558636] RSP: 0018:ffffd2bb444afab8 EFLAGS: 00010212
[   78.559092] RAX: 0000000000001000 RBX: 0000000000000027 RCX: 000000000000000c
[   78.559652] RDX: ffffffffffffffff RSI: ffff8f2bcdef0d71 RDI: 0000000000000000
[   78.560267] RBP: ffff8f2bc526b000 R08: 0000000000000610 R09: 00000000e096ebe3
[   78.560839] R10: 0000000074d3def0 R11: 0000000085971d85 R12: ffff8f2be536fae0
[   78.561443] R13: ffffd2bb444afb08 R14: 0000000000000000 R15: ffff8f2bcdef0d61
[   78.562019] FS:  00007fe2289c94c0(0000) GS:ffff8f2f478c2000(0000) knlGS:0000000000000000
[   78.562673] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   78.563133] CR2: 0000000000000000 CR3: 000000011e6ec001 CR4: 0000000000772ef0
[   78.563656] PKRU: 55555554
[   78.563892] Call Trace:
[   78.564111]  <TASK>
[   78.564315]  erofs_xattr_fill_inode_fingerprint+0x95/0x150 [erofs]
[   78.564785]  erofs_ishare_fill_inode+0x75/0x260 [erofs]
[   78.565193]  erofs_fill_inode+0x12e/0x190 [erofs]
[   78.565603]  erofs_iget+0x85/0xc0 [erofs]
[   78.565950]  erofs_lookup+0xe6/0xf0 [erofs]
[   78.566312]  __lookup_slow+0x5b/0x100
[   78.566631]  lookup_slow+0x39/0x60
[   78.566914]  path_lookupat+0x19b/0x2a0
[   78.567223]  filename_lookup+0xf0/0x200
[   78.567534]  ? filldir64+0x38/0x190
[   78.567822]  vfs_statx+0x7d/0x150
[   78.568096]  do_statx+0x66/0xb0
[   78.568367]  __x64_sys_statx+0x64/0xd0
[   78.568670]  do_syscall_64+0x8d/0x460
[   78.568974]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[   78.569367] RIP: 0033:0x7fe228b5c0de
[   78.569665] Code: 2d 0d 00 ba ff ff ff ff 64 c7 00 16 00 00 00 e9 a5 fd ff ff e8 53 c0 01 00 0f 1f 00 f3 0f 1e fa 41 89 ca b8 4c 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2a 89 c1 85 c0 74 0f 48 8b 05 05 2d 0d 00 64
[   78.570936] RSP: 002b:00007ffec5afe428 EFLAGS: 00000246 ORIG_RAX: 000000000000014c
[   78.571485] RAX: ffffffffffffffda RBX: 0000564bf6a2c498 RCX: 00007fe228b5c0de
[   78.572007] RDX: 0000000000000900 RSI: 00007ffec5afe560 RDI: 00000000ffffff9c
[   78.572532] RBP: 0000000000000002 R08: 00007ffec5afe430 R09: 00000000f6a31900
[   78.573061] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
[   78.573595] R13: 0000564bf6a319f3 R14: 0000000000000000 R15: 0000564bf6a2c480
[   78.574130]  </TASK>
[   78.574334] Modules linked in: erofs loop nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 rfkill ip_set nf_tables intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit sunrpc libnvdimm snd_hda_codec_generic kvm_intel snd_hda_intel snd_hda_codec rapl snd_hda_core pcspkr snd_intel_dspcfg i2c_piix4 joydev virtio_balloon snd_hwdep i2c_smbus rtc_cmos eni_vdpa vdpa sg fuse fsdev_dax sr_mod bochs cdrom drm_shmem_helper drm_client_lib drm_kms_helper sd_mod ahci ata_generic libahci ata_piix drm libata virtio_net net_failover failover serio_raw dm_mirror dm_region_hash dm_log dm_multipath dm_mod
[   78.578967] CR2: 0000000000000000

Fixes: 5ef3208e3be5 ("erofs: introduce the page cache share feature")

Signed-off-by: Gou Hao <gouhao@uniontech.com>
---
 fs/erofs/super.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index ce05557bd998..c641153c5d8f 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -889,6 +889,11 @@ static int erofs_fc_reconfigure(struct fs_context *fc)
 	if (test_opt(&sbi->opt, SUPERBLOCK_SHARE))
 		return -EBUSY;
 
+	/* Enabling inode sharing by remount is not supported.  */
+	if (test_opt(&new_sbi->opt, INODE_SHARE) &&
+	    !test_opt(&sbi->opt, INODE_SHARE))
+		return -EBUSY;
+
 	if (new_sbi->domain_id)
 		erofs_info(sb, "ignoring reconfiguration for domain_id.");
 
-- 
2.20.1