]> www.infradead.org Git - users/jedix/linux-maple.git/commit
gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add
authorAndrew Price <anprice@redhat.com>
Wed, 28 May 2025 15:02:37 +0000 (16:02 +0100)
committerAndreas Gruenbacher <agruenba@redhat.com>
Fri, 30 May 2025 17:20:20 +0000 (19:20 +0200)
commit9126d2754c5e5d1818765811a10af0a14cf1fa0a
tree84f2b0046b39a587631a490dcdea323a92099836
parent914873bc7df913db988284876c16257e6ab772c6
gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add

When gfs2_sys_fs_add() fails, it sets sb->s_fs_info to NULL on its error
path (see commit 0d515210b696 ("GFS2: Add kobject release method")).
The intention seems to be to prevent dereferencing sb->s_fs_info once
the object pointed to has been deallocated, but that would be better
achieved by setting the pointer to NULL in free_sbd().

As a consequence, when the call to gfs2_sys_fs_add() fails in
gfs2_fill_super(), sdp = GFS2_SB(inode) will evaluate to NULL in iput()
-> gfs2_drop_inode(), and accessing sdp->sd_flags will be a NULL pointer
dereference.

Fix that by only setting sb->s_fs_info to NULL when actually freeing the
object pointed to in free_sbd().

Fixes: ae9f3bd8259a ("gfs2: replace sd_aspace with sd_inode")
Reported-by: syzbot+b12826218502df019f9d@syzkaller.appspotmail.com
Signed-off-by: Andrew Price <anprice@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
fs/gfs2/ops_fstype.c
fs/gfs2/sys.c