Commit:     817794e0df5fea495396c18878804044436832be
Parent:     541510fc28b72eab37361e9e95f48746b4d3302b
Author:     Kirill Kuvaldin <[EMAIL PROTECTED]>
AuthorDate: Tue Jul 31 00:38:58 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Tue Jul 31 15:39:41 2007 -0700

    isofs: mounting to regular file may succeed
    It turned out that mounting a corrupted ISO image to a regular file may
    succeed, e.g.  if an image was prepared as follows:
    $ dd if=correct.iso of=bad.iso bs=4k count=8
    We then can mount it to a regular file:
    # mount -o loop -t iso9660 bad.iso /tmp/file
    But mounting it to a directory fails with -ENOTDIR, simply because
    the root directory inode doesn't have S_IFDIR set and the condition
    in graft_tree() is met:
        if (S_ISDIR(nd->dentry->d_inode->i_mode) !=
                return -ENOTDIR
    This is because the root directory inode was read from an incorrect
    block. It's supposed to be read from sbi->s_firstdatazone, which is
    an absolute value and gets messed up in the case of an incorrect image.
    In order to somehow circumvent this we have to check that the root
    directory inode is actually a directory after all.
    Signed-off-by: Kirill Kuvaldin <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
 fs/isofs/inode.c |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 95c72aa..043b470 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -846,6 +846,15 @@ root_found:
                goto out_no_root;
        if (!inode->i_op)
                goto out_bad_root;
+       /* Make sure the root inode is a directory */
+       if (!S_ISDIR(inode->i_mode)) {
+               printk(KERN_WARNING
+                       "isofs_fill_super: root inode is not a directory. "
+                       "Corrupted media?\n");
+               goto out_iput;
+       }
        /* get the root dentry */
        s->s_root = d_alloc_root(inode);
        if (!(s->s_root))
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to