From: Theodore Ts'o Date: Thu, 27 Apr 2023 23:18:01 +0000 (-0400) Subject: ext4: fix lost error code reporting in __ext4_fill_super() X-Git-Tag: v6.1.168~3 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2299f71698d2f3e64969bee30d64901b6749bc37;p=thirdparty%2Fkernel%2Fstable.git ext4: fix lost error code reporting in __ext4_fill_super() commit d5e72c4e3256335d6fb75c2e321144f93141f4f5 upstream. When code was factored out of __ext4_fill_super() into ext4_percpu_param_init() the error return was discarded. This meant that it was possible for __ext4_fill_super() to return zero, indicating success, without the struct super getting completely filled in, leading to a potential NULL pointer dereference. Reported-by: syzbot+bbf0f9a213c94f283a5c@syzkaller.appspotmail.com Fixes: 1f79467c8a6b ("ext4: factor out ext4_percpu_param_init() ...") Link: https://syzkaller.appspot.com/bug?id=6dac47d5e58af770c0055f680369586ec32e144c Signed-off-by: Theodore Ts'o Reviewed-by: Jason Yan Signed-off-by: Greg Kroah-Hartman --- diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 1dd1148b10cc5..d786934e96c73 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5531,7 +5531,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) sbi->s_journal->j_commit_callback = ext4_journal_commit_callback; - if (ext4_percpu_param_init(sbi)) + err = ext4_percpu_param_init(sbi); + if (err) goto failed_mount6; if (ext4_has_feature_flex_bg(sb))