diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2023-04-28 02:18:01 +0300 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2023-04-28 19:56:40 +0300 |
| commit | d5e72c4e3256335d6fb75c2e321144f93141f4f5 (patch) | |
| tree | e257e752ba56b70041947324686405514c185e52 /fs/ext4 | |
| parent | 856dd6c5981260b4d1aa84b78373ad54a203db48 (diff) | |
| download | linux-d5e72c4e3256335d6fb75c2e321144f93141f4f5.tar.xz | |
ext4: fix lost error code reporting in __ext4_fill_super()
When code was factored out of __ext4_fill_super() into
ext4_percpu_param_init() the error return was discarded. This meant
that it was possible for __ext4_fill_super() to return zero,
indicating success, without the struct super getting completely filled
in, leading to a potential NULL pointer dereference.
Reported-by: syzbot+bbf0f9a213c94f283a5c@syzkaller.appspotmail.com
Fixes: 1f79467c8a6b ("ext4: factor out ext4_percpu_param_init() ...")
Link: https://syzkaller.appspot.com/bug?id=6dac47d5e58af770c0055f680369586ec32e144c
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Diffstat (limited to 'fs/ext4')
| -rw-r--r-- | fs/ext4/super.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/ext4/super.c b/fs/ext4/super.c index f16492b8c98d..8ed6450effaa 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5502,7 +5502,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) sbi->s_journal->j_commit_callback = ext4_journal_commit_callback; - if (ext4_percpu_param_init(sbi)) + err = ext4_percpu_param_init(sbi); + if (err) goto failed_mount6; if (ext4_has_feature_flex_bg(sb)) |