Re: [PATCH] erofs: reject turning inode_share on during remount

[Gao Xiang <xiang@kernel.org>]

Hi Hao,

On Fri, Nov 13, 2026 at 07:32:04PM +0800, Gou Hao wrote:
> The inode_share and domain_id constraint is validated when a
> superblock is initialized, but remount replaces the live mount options
> with a newly parsed option set without rechecking it.
> 
> Therefore a filesystem mounted without domain_id can enable inode_share
> by remount.  For an image with ishare xattrs, the next lookup of a
> regular file then passes a NULL domain_id to
> erofs_xattr_fill_inode_fingerprint() and crashes.
> 
> Since domain_id cannot be changed by remount, reject turning inode_share
> on during remount.
> 
> Reproducer:
> 
> 	mkfs.erofs --xattr-inode-digest=erofs.fingerprint.v1 img  man/
> 	mount img t
> 	mount -o remount,inode_share t
> 	ls t/
> 
> Full crash log:
> 
> [   50.416381] erofs (device loop0): mounted with root inode @ nid 37.
> [   78.553276] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [   78.553882] #PF: supervisor read access in kernel mode
> [   78.554326] #PF: error_code(0x0000) - not-present page

The full stack can be simplified a bit, there are two many overly
long lines.

I can simplify it later manually.

> [   78.554762] PGD 0 P4D 0
> [   78.555014] Oops: Oops: 0000 [#1] SMP NOPTI
> [   78.555423] CPU: 4 UID: 0 PID: 4446 Comm: ls Kdump: loaded Not tainted 7.3.0-erofs #2 PREEMPTLAZY
> [   78.556105] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
> [   78.556942] RIP: 0010:strlen+0x0/0x20
> [   78.557284] Code: f7 75 ec 31 c0 e9 40 76 02 00 48 89 f8 c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 e9 07
> [   78.558636] RSP: 0018:ffffd2bb444afab8 EFLAGS: 00010212
> [   78.559092] RAX: 0000000000001000 RBX: 0000000000000027 RCX: 000000000000000c
> [   78.559652] RDX: ffffffffffffffff RSI: ffff8f2bcdef0d71 RDI: 0000000000000000
> [   78.560267] RBP: ffff8f2bc526b000 R08: 0000000000000610 R09: 00000000e096ebe3
> [   78.560839] R10: 0000000074d3def0 R11: 0000000085971d85 R12: ffff8f2be536fae0
> [   78.561443] R13: ffffd2bb444afb08 R14: 0000000000000000 R15: ffff8f2bcdef0d61
> [   78.562019] FS:  00007fe2289c94c0(0000) GS:ffff8f2f478c2000(0000) knlGS:0000000000000000
> [   78.562673] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   78.563133] CR2: 0000000000000000 CR3: 000000011e6ec001 CR4: 0000000000772ef0
> [   78.563656] PKRU: 55555554
> [   78.563892] Call Trace:
> [   78.564111]  <TASK>
> [   78.564315]  erofs_xattr_fill_inode_fingerprint+0x95/0x150 [erofs]
> [   78.564785]  erofs_ishare_fill_inode+0x75/0x260 [erofs]
> [   78.565193]  erofs_fill_inode+0x12e/0x190 [erofs]
> [   78.565603]  erofs_iget+0x85/0xc0 [erofs]
> [   78.565950]  erofs_lookup+0xe6/0xf0 [erofs]
> [   78.566312]  __lookup_slow+0x5b/0x100
> [   78.566631]  lookup_slow+0x39/0x60
> [   78.566914]  path_lookupat+0x19b/0x2a0
> [   78.567223]  filename_lookup+0xf0/0x200
> [   78.567534]  ? filldir64+0x38/0x190
> [   78.567822]  vfs_statx+0x7d/0x150
> [   78.568096]  do_statx+0x66/0xb0
> [   78.568367]  __x64_sys_statx+0x64/0xd0
> [   78.568670]  do_syscall_64+0x8d/0x460
> [   78.568974]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [   78.569367] RIP: 0033:0x7fe228b5c0de
> [   78.569665] Code: 2d 0d 00 ba ff ff ff ff 64 c7 00 16 00 00 00 e9 a5 fd ff ff e8 53 c0 01 00 0f 1f 00 f3 0f 1e fa 41 89 ca b8 4c 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2a 89 c1 85 c0 74 0f 48 8b 05 05 2d 0d 00 64
> [   78.570936] RSP: 002b:00007ffec5afe428 EFLAGS: 00000246 ORIG_RAX: 000000000000014c
> [   78.571485] RAX: ffffffffffffffda RBX: 0000564bf6a2c498 RCX: 00007fe228b5c0de
> [   78.572007] RDX: 0000000000000900 RSI: 00007ffec5afe560 RDI: 00000000ffffff9c
> [   78.572532] RBP: 0000000000000002 R08: 00007ffec5afe430 R09: 00000000f6a31900
> [   78.573061] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
> [   78.573595] R13: 0000564bf6a319f3 R14: 0000000000000000 R15: 0000564bf6a2c480
> [   78.574130]  </TASK>
> [   78.574334] Modules linked in: erofs loop nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 rfkill ip_set nf_tables intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit sunrpc libnvdimm snd_hda_codec_generic kvm_intel snd_hda_intel snd_hda_codec rapl snd_hda_core pcspkr snd_intel_dspcfg i2c_piix4 joydev virtio_balloon snd_hwdep i2c_smbus rtc_cmos eni_vdpa vdpa sg fuse fsdev_dax sr_mod bochs cdrom drm_shmem_helper drm_client_lib drm_kms_helper sd_mod ahci ata_generic libahci ata_piix drm libata virtio_net net_failover failover serio_raw dm_mirror dm_region_hash dm_log dm_multipath dm_mod
> [   78.578967] CR2: 0000000000000000
> 
> Fixes: 5ef3208e3be5 ("erofs: introduce the page cache share feature")
> 
> Signed-off-by: Gou Hao <gouhao@uniontech.com>

Reviewed-by: Gao Xiang <xiang@kernel.org>

Thanks,
Gao Xiang