ext4: fix lost error code reporting in __ext4_fill_super()

commit d5e72c4e3256335d6fb75c2e321144f93141f4f5 upstream.

When code was factored out of __ext4_fill_super() into
ext4_percpu_param_init() the error return was discarded.  This meant
that it was possible for __ext4_fill_super() to return zero,
indicating success, without the struct super getting completely filled
in, leading to a potential NULL pointer dereference.

Reported-by: syzbot+bbf0f9a213c94f283a5c@syzkaller.appspotmail.com
Fixes: 1f79467c8a6b ("ext4: factor out ext4_percpu_param_init() ...")
Link: https://syzkaller.appspot.com/bug?id=6dac47d5e58af770c0055f680369586ec32e144c
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 1dd1148b10cc557b60f710aa9fdb109790d1bbcf..d786934e96c731843e131b9f1960bfe0724e1f29 100644 (file)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5531,7 +5531,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
                sbi->s_journal->j_commit_callback =
                        ext4_journal_commit_callback;
 
-       if (ext4_percpu_param_init(sbi))
+       err = ext4_percpu_param_init(sbi);
+       if (err)
                goto failed_mount6;
 
        if (ext4_has_feature_flex_bg(sb))