On 2023/4/28 11:16, Theodore Ts'o wrote:
When code was factored out of __ext4_fill_super() into
ext4_percpu_param_init() the error return was discard. This meant
that it was possible for __ext4_fill_super() to return zero,
indicating success, without the struct super getting completely filled
in, leading to a potential NULL pointer dereference.
Reported-by: syzbot+bbf0f9a213c94f283a5c@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: 1f79467c8a6b ("ext4: factor out ext4_percpu_param_init() ...")
Cc: Jason Yan <yanaijie@xxxxxxxxxx>
Link: https://syzkaller.appspot.com/bug?id=6dac47d5e58af770c0055f680369586ec32e144c
Signed-off-by: Theodore Ts'o <tytso@xxxxxxx>
---
fs/ext4/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 403cc0e6cd65..b11907e1fab2 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5503,7 +5503,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
sbi->s_journal->j_commit_callback =
ext4_journal_commit_callback;
- if (ext4_percpu_param_init(sbi))
+ err = ext4_percpu_param_init(sbi);
+ if (err)
goto failed_mount6;
if (ext4_has_feature_flex_bg(sb))
Reviewed-by: Jason Yan <yanaijie@xxxxxxxxxx>
