Commit d5e72c4e authored by Theodore Ts'o's avatar Theodore Ts'o
Browse files

ext4: fix lost error code reporting in __ext4_fill_super() 



When code was factored out of __ext4_fill_super() into
ext4_percpu_param_init() the error return was discarded.  This meant
that it was possible for __ext4_fill_super() to return zero,
indicating success, without the struct super getting completely filled
in, leading to a potential NULL pointer dereference.

Reported-by: default avatar <syzbot+bbf0f9a213c94f283a5c@syzkaller.appspotmail.com>
Fixes: 1f79467c ("ext4: factor out ext4_percpu_param_init() ...")
Link: https://syzkaller.appspot.com/bug?id=6dac47d5e58af770c0055f680369586ec32e144c


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Reviewed-by: default avatarJason Yan <yanaijie@huawei.com>
parent 856dd6c5

fs/ext4/super.c

+2 −1
Original line number Diff line number Diff line
@@ -5502,7 +5502,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) 
		sbi->s_journal->j_commit_callback =

			ext4_journal_commit_callback;



	if (ext4_percpu_param_init(sbi))

	err = ext4_percpu_param_init(sbi);

	if (err)

		goto failed_mount6;



	if (ext4_has_feature_flex_bg(sb))