diff options
| author | Andrew Price <[email protected]> | 2025-05-28 15:02:37 +0000 |
|---|---|---|
| committer | Andreas Gruenbacher <[email protected]> | 2025-05-30 17:20:20 +0000 |
| commit | 9126d2754c5e5d1818765811a10af0a14cf1fa0a (patch) | |
| tree | 84f2b0046b39a587631a490dcdea323a92099836 /mm/mm_init.c | |
| parent | Merge tag 'x86-build-2025-05-25' of git://git.kernel.org/pub/scm/linux/kernel... (diff) | |
| download | kernel-9126d2754c5e5d1818765811a10af0a14cf1fa0a.tar.gz kernel-9126d2754c5e5d1818765811a10af0a14cf1fa0a.zip | |
gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add
When gfs2_sys_fs_add() fails, it sets sb->s_fs_info to NULL on its error
path (see commit 0d515210b696 ("GFS2: Add kobject release method")).
The intention seems to be to prevent dereferencing sb->s_fs_info once
the object pointed to has been deallocated, but that would be better
achieved by setting the pointer to NULL in free_sbd().
As a consequence, when the call to gfs2_sys_fs_add() fails in
gfs2_fill_super(), sdp = GFS2_SB(inode) will evaluate to NULL in iput()
-> gfs2_drop_inode(), and accessing sdp->sd_flags will be a NULL pointer
dereference.
Fix that by only setting sb->s_fs_info to NULL when actually freeing the
object pointed to in free_sbd().
Fixes: ae9f3bd8259a ("gfs2: replace sd_aspace with sd_inode")
Reported-by: [email protected]
Signed-off-by: Andrew Price <[email protected]>
Signed-off-by: Andreas Gruenbacher <[email protected]>
Diffstat (limited to 'mm/mm_init.c')
0 files changed, 0 insertions, 0 deletions
