Merge tag 'gfs2-for-6.16-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2

torvalds · torvalds · commit fe4281644c62 · 2025-06-02T15:53:43.000-07:00
Pull gfs2 fix from Andreas Gruenbacher:

 - Fix a NULL pointer dereference reported by syzbot

* tag 'gfs2-for-6.16-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2:
  gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
@@ -64,7 +64,10 @@ static void gfs2_tune_init(struct gfs2_tune *gt)
 
 void free_sbd(struct gfs2_sbd *sdp)
 {
+	struct super_block *sb = sdp->sd_vfs;
+
 	free_percpu(sdp->sd_lkstats);
+	sb->s_fs_info = NULL;
 	kfree(sdp);
 }
 
@@ -1314,7 +1317,6 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
 	iput(sdp->sd_inode);
 fail_free:
 	free_sbd(sdp);
-	sb->s_fs_info = NULL;
 	return error;
 }
 
diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
@@ -764,7 +764,6 @@ int gfs2_sys_fs_add(struct gfs2_sbd *sdp)
 	fs_err(sdp, "error %d adding sysfs files\n", error);
 	kobject_put(&sdp->sd_kobj);
 	wait_for_completion(&sdp->sd_kobj_unregister);
-	sb->s_fs_info = NULL;
 	return error;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -64,7 +64,10 @@ static void gfs2_tune_init(struct gfs2_tune *gt)`
`64`	`64`
`65`	`65`	`void free_sbd(struct gfs2_sbd *sdp)`
`66`	`66`	`{`
	`67`	`+ struct super_block *sb = sdp->sd_vfs;`
	`68`	`+`
`67`	`69`	`free_percpu(sdp->sd_lkstats);`
	`70`	`+ sb->s_fs_info = NULL;`
`68`	`71`	`kfree(sdp);`
`69`	`72`	`}`
`70`	`73`
`@@ -1314,7 +1317,6 @@ static int gfs2_fill_super(struct super_block sb, struct fs_context fc)`
`1314`	`1317`	`iput(sdp->sd_inode);`
`1315`	`1318`	`fail_free:`
`1316`	`1319`	`free_sbd(sdp);`
`1317`		`- sb->s_fs_info = NULL;`
`1318`	`1320`	`return error;`
`1319`	`1321`	`}`
`1320`	`1322`
Original file line number	Diff line number	Diff line change
`@@ -764,7 +764,6 @@ int gfs2_sys_fs_add(struct gfs2_sbd *sdp)`
`764`	`764`	`fs_err(sdp, "error %d adding sysfs files\n", error);`
`765`	`765`	`kobject_put(&sdp->sd_kobj);`
`766`	`766`	`wait_for_completion(&sdp->sd_kobj_unregister);`
`767`		`- sb->s_fs_info = NULL;`
`768`	`767`	`return error;`
`769`	`768`	`}`
`770`	`769`