ext4: fix missing iput of root inode for some mount error paths

This assures that the root inode is not leaked, and that sb->s_root is
NULL, which will prevent generic_shutdown_super() from doing extra
work, including call sync_filesystem, which ultimately results in
ext4_sync_fs() getting called with an uninitialized struct super,
which is the cause of the crash noted in Kernel Bugzilla #26752.

https://bugzilla.kernel.org/show_bug.cgi?id=26752

Signed-off-by: Manish Katiyar <mkatiyar@gmail.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

1 files changed, 3 insertions, 2 deletions

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 33c398785e53..bd6e86aa82aa 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3521,17 +3521,16 @@ no_journal:
         if (IS_ERR(root)) {
                 ext4_msg(sb, KERN_ERR, "get root inode failed");
                 ret = PTR_ERR(root);
+                root = NULL;
                 goto failed_mount4;
         }
         if (!S_ISDIR(root->i_mode) || !root->i_blocks || !root->i_size) {
-                iput(root);
                 ext4_msg(sb, KERN_ERR, "corrupt root inode, run e2fsck");
                 goto failed_mount4;
         }
         sb->s_root = d_alloc_root(root);
         if (!sb->s_root) {
                 ext4_msg(sb, KERN_ERR, "get root dentry failed");
-                iput(root);
                 ret = -ENOMEM;
                 goto failed_mount4;
         }
@@ -3647,6 +3646,8 @@ cantfind_ext4:
         goto failed_mount;
 
 failed_mount4:
+        iput(root);
+        sb->s_root = NULL;
         ext4_msg(sb, KERN_ERR, "mount failed");
         destroy_workqueue(EXT4_SB(sb)->dio_unwritten_wq);
 failed_mount_wq: